collecting-open-source-intelligence

mukul975/Anthropic-Cybersecurity-SkillsSecurityAudit pendingSnapshot b50e4b9d32d1

Summary

This source did not publish a separate summary. Review SKILL.md before using the skill.

SKILL.md

Collecting Open-Source Intelligence

When to Use

Use this skill when:

Investigating external infrastructure associated with a phishing campaign targeting your organization
Enriching threat actor profiles with publicly observable indicators (WHOIS, ASN data, SSL certificates)
Conducting authorized attack surface discovery to understand your organization's external exposure

Do not use this skill for active scanning against targets without explicit written authorization — OSINT collection must remain passive (no packets sent to target systems) unless scope permits active recon.

Prerequisites

Maltego CE or commercial license for graph-based link analysis
Shodan API key (https://shodan.io) for internet-wide device/service discovery
OSINT Framework familiarity (https://osintframework.com) for tool selection
SpiderFoot HX or open-source SpiderFoot for automated OSINT correlation

Workflow

Step 1: Define Collection Requirements

Establish the intelligence requirement (IR) before collecting. Document:

Target: threat actor group, malicious domain, IP range, or organization
Priority Intelligence Requirements (PIRs): What specific questions need answering?
Legal authority: Passive OSINT is legal; active probing requires authorization
Data handling: TLP classification for collected intelligence

Step 2: Passive DNS and WHOIS Investigation

# Passive DNS via SecurityTrails API
curl "https://api.securitytrails.com/v1/domain/evil-domain.com/dns/a" \
  -H "apikey: YOUR_KEY"

# WHOIS history via ARIN / RIPE
whois -h whois.arin.net evil-domain.com

# Certificate transparency logs (no API key required)
curl "https://crt.sh/?q=%.evil-domain.com&output=json" | jq '.[].name_value'

Certificate transparency logs reveal all subdomains for a target domain, often exposing staging, VPN, or internal infrastructure inadvertently made public.

import shodan

api = shodan.Shodan("YOUR_SHODAN_API_KEY")

# Search for specific C2 framework signatures (Cobalt Strike beacon)
results = api.search('product:"Cobalt Strike" port:443')
for r in results['matches']:
    print(r['ip_str'], r['port'], r['org'], r.get('ssl', {}).get('cert', {}).get('subject', ''))

# Find infrastructure associated with a known threat actor's ASN
results = api.search('asn:AS12345 http.title:"Redirector"')

# SpiderFoot CLI for automated OSINT
python sf.py -s evil-domain.com -m sfp_shodan,sfp_virustotal,sfp_passivetotal \
  -o TF -R result.json

Term	Definition
Passive OSINT	Intelligence collection that does not send any packets to target systems — uses public databases, search engines, cached data
PIR	Priority Intelligence Requirement — specific question the intelligence collection must answer, preventing unfocused data gathering
Certificate Transparency	Public log of all SSL/TLS certificates issued by CAs, enabling discovery of subdomains via crt.sh
Pivoting	Using one data point (IP, email, registrant name) to discover related infrastructure or accounts
ASN	Autonomous System Number — block of IP addresses under a single routing policy; useful for clustering threat actor infrastructure
Co-hosted Domains	Multiple domains resolving to the same IP, potentially indicating shared attacker infrastructure

collecting-open-source-intelligence

Summary

SKILL.md

Collecting Open-Source Intelligence

When to Use

Prerequisites

Workflow

Step 1: Define Collection Requirements

Step 2: Passive DNS and WHOIS Investigation

Step 3: Shodan Infrastructure Mapping

Step 4: Maltego Graph Analysis

Step 5: Dark Web and Paste Site Monitoring

Key Concepts

Tools & Systems

Common Pitfalls

Related skills