analyzing-tls-certificate-transparency-logs

by mukul975

The analyzing-tls-certificate-transparency-logs skill helps security teams query Certificate Transparency data with crt.sh, pycrtsh, and related feeds to find suspicious TLS certificates, lookalike domains, typosquatting, and unauthorized issuance. It supports threat hunting, brand protection, and certificate monitoring with a practical workflow and similarity checks.

Stars0

Favorites0

Comments0

AddedMay 9, 2026

CategoryThreat Intelligence

Install Command

npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-tls-certificate-transparency-logs

Curation Score

This skill scores 78/100, which means it is a solid listing candidate for directory users who need Certificate Transparency log analysis for phishing, unauthorized issuance, and brand impersonation detection. The repository provides a real workflow, concrete APIs, and a supporting script, so an agent can understand what to do with less guesswork than a generic prompt, though setup and operational boundaries could be clearer.

78/100

Strengths

Clear, security-operations-focused trigger: the skill explicitly targets CT log analysis for phishing, shadow IT, and unauthorized certificate issuance.
Concrete operational references: SKILL.md, an API reference, and scripts/agent.py show pycrtsh, crt.sh REST queries, and certstream usage.
Workflow value beyond theory: the script includes certificate searching, certificate detail lookup, direct API querying, and Levenshtein-based similarity checking for typosquatting detection.

Cautions

No install command in SKILL.md, so users may need to infer setup and dependency installation themselves.
Prerequisites and examples are somewhat generic; the repo does not fully spell out end-to-end execution steps, validation, or edge-case handling.

Cybersecurity Security Crt Sh Certstream Domain Monitoring Phishing Logs Analysis

Overview

Overview of analyzing-tls-certificate-transparency-logs skill

What this skill does

The analyzing-tls-certificate-transparency-logs skill helps you query Certificate Transparency data to find suspicious TLS certificates, lookalike domains, and newly issued certificates that may indicate phishing or unauthorized issuance. It is most useful for defenders doing threat hunting, brand protection, and certificate monitoring with crt.sh, pycrtsh, or related CT feeds.

Who should use it

Use the analyzing-tls-certificate-transparency-logs skill if you work in SOC, threat intelligence, incident response, or security engineering and need a repeatable way to inspect certificate issuance for a domain. It fits readers who want practical analyzing-tls-certificate-transparency-logs for Threat Intelligence rather than a general-purpose web search prompt.

Why it is different

This skill is not just “search CT logs.” It includes a workflow for identifying typosquatting, brand impersonation, and shadow IT, plus a lightweight similarity check using Levenshtein distance. That makes it better than a generic prompt when you need domain-centric triage, not just raw certificate lookup.

How to Use analyzing-tls-certificate-transparency-logs skill

Install and verify the skill

Use the directory install flow: npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-tls-certificate-transparency-logs. After installing, confirm the skill body and supporting files are present before relying on it in automation. The most useful files are SKILL.md, references/api-reference.md, and scripts/agent.py.

Start with the right input

For strong analyzing-tls-certificate-transparency-logs usage, give the skill a target domain, a suspected lookalike, and your detection goal. Good inputs look like: “Check example.com for newly issued certificates, subdomain abuse, and typo variants from the last 30 days.” Weak inputs like “analyze CT logs” leave too much ambiguity and produce broad results.

Read the repo in the right order

Begin with SKILL.md to learn intent, prerequisites, and when to use the workflow. Then read references/api-reference.md for the actual query patterns and field meanings. Use scripts/agent.py to understand how the similarity logic, certificate filtering, and CT lookups are implemented before you adapt it into your own pipeline.

Turn a rough goal into a usable prompt

A practical analyzing-tls-certificate-transparency-logs guide prompt should specify: target brand or domain, time window, whether expired certificates matter, whether to query crt.sh directly or through pycrtsh, and what counts as suspicious. Example: “Find certificates issued in the last 14 days for acme.com, flag SANs that differ by one to three edits, ignore expired certs, and summarize possible phishing risk with issuer and issuance date.”

analyzing-tls-certificate-transparency-logs skill FAQ

Is this skill only for phishing detection?

No. Phishing is a major use case, but the skill also supports certificate monitoring, unauthorized issuance review, and shadow IT discovery. If you need broader certificate visibility for a brand or domain, the analyzing-tls-certificate-transparency-logs skill is still a good fit.

Do I need to be a Python expert?

Not necessarily. The skill is usable as a guided workflow, but the repository does expose Python examples through pycrtsh and direct crt.sh requests. If you can read basic Python and understand domain names, you can usually use it effectively.

When should I not use this skill?

Do not use it when you need a full enterprise CT monitoring platform, historical certificate analytics at scale, or policy enforcement. It is better suited to investigation, validation, and targeted monitoring than to long-running production telemetry without additional engineering.

Is it better than a generic prompt?

Yes, when the task depends on CT-specific fields such as common_name, name_value, issuer_name, and issuance dates. A generic prompt may miss the right query syntax or filtering logic, while this skill gives you a more reliable path for analyzing-tls-certificate-transparency-logs usage.

How to Improve analyzing-tls-certificate-transparency-logs skill

Give it better targeting data

The best results come from precise inputs: exact brand names, known domains, confusingly similar variants, and a date window. If you are using analyzing-tls-certificate-transparency-logs install output in an investigation, include the main domain, top lookalike candidates, and any known trusted issuers so the results can be narrowed quickly.

Be explicit about what should be flagged

The script can surface many certificates, but your outcome improves when you define suspiciousness upfront. Say whether you care about wildcard SANs, new issuers, recently issued certs, expired certificates, or one-edit typos. This reduces noise and makes the review more actionable.

Use iteration after the first run

Treat the first output as triage, not final evidence. Re-run the workflow with tighter domain patterns, a narrower time range, or a stricter similarity threshold if the initial set is too large. For analyzing-tls-certificate-transparency-logs skill results, the biggest quality jump usually comes from refining the domain scope rather than asking for a longer summary.

Feed back concrete misses

If the output misses known suspicious certificates, update the prompt with the exact failure mode: “include wildcard subdomains,” “do not exclude expired records,” or “query crt.sh JSON directly instead of only pycrtsh search results.” That kind of correction improves future runs more than general requests for “more accuracy.”

Ratings & Reviews

No ratings yet

Share your review

0/10000

Latest reviews

Saving...

more skill

evaluating-threat-intelligence-platforms

by mukul975

evaluating-threat-intelligence-platforms helps you compare TIP products by feed ingestion, STIX/TAXII support, automation, analyst workflow, integrations, and total cost of ownership. Use this evaluating-threat-intelligence-platforms guide for procurement, migration, or maturity planning, including evaluating-threat-intelligence-platforms for Threat Modeling when platform choice affects traceability and evidence sharing.

Threat Modeling

Favorites 0GitHub 0

detecting-privilege-escalation-attempts

by mukul975

detecting-privilege-escalation-attempts helps hunt privilege escalation on Windows and Linux, including token manipulation, UAC bypass, unquoted service paths, kernel exploits, and sudo/doas abuse. Built for threat hunting teams that need a practical workflow, reference queries, and helper scripts.

Threat Hunting

Favorites 0GitHub 0

detecting-insider-threat-behaviors

by mukul975

detecting-insider-threat-behaviors helps analysts hunt insider-risk signals like unusual data access, off-hours activity, mass downloads, privilege abuse, and resignation-correlated theft. Use this detecting-insider-threat-behaviors guide for threat hunting, UEBA-style triage, and threat modeling with workflow templates, SIEM query examples, and risk weights.

Threat Modeling

Favorites 0GitHub 0

detecting-credential-dumping-techniques

by mukul975

The detecting-credential-dumping-techniques skill helps you detect LSASS access, SAM export, NTDS.dit theft, and comsvcs.dll MiniDump abuse using Sysmon Event ID 10, Windows Security logs, and SIEM correlation rules. It is built for threat hunting, detection engineering, and Security Audit workflows.

Security Audit

Favorites 0GitHub 0

detecting-command-and-control-over-dns

by mukul975

detecting-command-and-control-over-dns is a cybersecurity skill for spotting C2 over DNS, including tunneling, beaconing, DGA domains, and TXT/CNAME abuse. It supports SOC analysts, threat hunters, and security audits with entropy checks, passive DNS correlation, and Zeek or Suricata-style detection workflows.

Security Audit

Favorites 0GitHub 0

correlating-security-events-in-qradar

by mukul975

correlating-security-events-in-qradar helps SOC and detection teams correlate IBM QRadar offenses with AQL, offense context, custom rules, and reference data. Use this guide to investigate incidents, reduce false positives, and build stronger correlation logic for Incident Response.

Incident Response

Favorites 0GitHub 0

auditing-tls-certificate-transparency-logs

by mukul975

The auditing-tls-certificate-transparency-logs skill helps security teams monitor Certificate Transparency logs for owned domains, detect unauthorized certificate issuance, discover certificate-exposed subdomains, and track suspicious CA activity with a repeatable Security Audit workflow.

Security Audit

Favorites 0GitHub 0

analyzing-windows-event-logs-in-splunk

by mukul975

The analyzing-windows-event-logs-in-splunk skill helps SOC analysts investigate Windows Security, System, and Sysmon logs in Splunk for authentication attacks, privilege escalation, persistence, and lateral movement. Use it for incident triage, detection engineering, and timeline analysis with mapped SPL patterns and event ID guidance.

Incident Triage

Favorites 0GitHub 0

analyzing-windows-amcache-artifacts

by mukul975

The analyzing-windows-amcache-artifacts skill parses Windows Amcache.hve data to recover evidence of program execution, installed software, device activity, and driver loading for DFIR and security audit workflows. It uses AmcacheParser and regipy-based guidance to support artifact extraction, SHA-1 correlation, and timeline review.

Security Audit

Favorites 0GitHub 0

analyzing-powershell-empire-artifacts

by mukul975

analyzing-powershell-empire-artifacts skill helps Security Audit teams detect PowerShell Empire artifacts in Windows logs using Script Block Logging, Base64 launcher patterns, stager IOCs, module signatures, and detection references for triage and rule writing.

Security Audit

Favorites 0GitHub 0

analyzing-network-traffic-of-malware

by mukul975

analyzing-network-traffic-of-malware helps inspect PCAPs and telemetry from sandbox runs or incident response to find C2, exfiltration, payload downloads, DNS tunneling, and detection ideas. It is a practical analyzing-network-traffic-of-malware guide for Security Audit and malware triage.

Security Audit

Favorites 0GitHub 0

analyzing-indicators-of-compromise

by mukul975

Analyzing-indicators-of-compromise helps triage IOCs such as IPs, domains, URLs, file hashes, and email artifacts. It supports threat-intelligence workflows for enrichment, confidence scoring, and block/monitor/whitelist decisions using source-backed checks and clear analyst context.

Threat Intelligence

Favorites 0GitHub 0

analyzing-cyber-kill-chain

by mukul975

analyzing-cyber-kill-chain helps map intrusion activity to the Lockheed Martin Cyber Kill Chain to show what happened, where defenses held or failed, and which controls could have stopped the attack earlier. It is useful for incident response, detection-gap analysis, and analyzing-cyber-kill-chain for Threat Intelligence.

Threat Intelligence

Favorites 0GitHub 0

collecting-indicators-of-compromise

by mukul975

collecting-indicators-of-compromise skill for extracting, enriching, scoring, and exporting IOCs from incident evidence. Use it for Security Audit workflows, threat intel sharing, and STIX 2.1 output when you need a practical collecting-indicators-of-compromise guide instead of a generic incident-response prompt.

Security Audit

Favorites 0GitHub 0

detecting-business-email-compromise

by mukul975

The detecting-business-email-compromise skill helps analysts, SOC teams, and incident responders identify BEC attempts using email-header checks, social-engineering clues, detection logic, and response-oriented workflows. Use it as a practical detecting-business-email-compromise guide for triage, validation, and containment.

Incident Response

Favorites 0GitHub 6.1k

analyzing-command-and-control-communication

by mukul975

analyzing-command-and-control-communication helps analyze malware C2 traffic to identify beaconing, decode commands, map infrastructure, and support Security Audit, threat hunting, and malware triage with PCAP-based evidence and practical workflow guidance.

Security Audit

Favorites 0GitHub 0