About

Imported from mukul975/anthropic-cybersecurity-skills (skills/analyzing-tls-certificate-transparency-logs/SKILL.md). Install upstream with npx skills add mukul975/anthropic-cybersecurity-skills --skill analyzing-tls-certificate-transparency-logs. Copyright stays with the author (Apache-2.0).

Analyzing TLS Certificate Transparency Logs

Name: analyzing-tls-certificate-transparency-logs
Author: mukul975

When to Use

When investigating security incidents that require analyzing tls certificate transparency logs
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Familiarity with security operations concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Instructions

Query crt.sh Certificate Transparency database to find certificates issued for domains similar to your organization's brand, detecting phishing infrastructure.

from pycrtsh import Crtsh

c = Crtsh()
# Search for certificates matching a domain
certs = c.search("example.com")
for cert in certs:
    print(cert["id"], cert["name_value"])

# Get full certificate details
details = c.get(certs[0]["id"], type="id")

Key analysis steps:

Query crt.sh for all certificates matching your domain pattern
Identify certificates with typosquatting variations (Levenshtein distance)
Flag certificates from unexpected CAs
Monitor for wildcard certificates on suspicious subdomains
Cross-reference with known phishing infrastructure

Examples

from pycrtsh import Crtsh
c = Crtsh()
certs = c.search("%.example.com")
for cert in certs:
    print(f"Issuer: {cert.get('issuer_name')}, Domain: {cert.get('name_value')}")

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/mukul975-anthropic-cybersecurity-skills-analyzing-tls-ce-68a7d8/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

mukul975-anthropic-cybersecurity-skills-analyzing-tls-ce-68a7d8.ocm.jsonjson

{
  "ocm": "1",
  "id": "mukul975-anthropic-cybersecurity-skills-analyzing-tls-ce-68a7d8",
  "kind": "skill",
  "name": "analyzing-tls-certificate-transparency-logs",
  "description": "Queries Certificate Transparency logs via crt.sh and pycrtsh to detect phishing domains, unauthorized certificate issuance, and shadow IT. Monitors newly issued certificates for typosquatting and brand impersonation using Levenshtein distance. Use for proactive phishing domain detection and certificate monitoring.",
  "publisher": "mukul975",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "marketing"
    ],
    "tags": [
      "skill-md",
      "certificate-transparency",
      "ct-logs",
      "crt-sh",
      "phishing-detection",
      "tls-monitoring",
      "security-operations",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Queries Certificate Transparency logs via crt.sh and pycrtsh to detect phishing domains, unauthorized certificate issuance, and shadow IT. Monitors newly issued certificates for typosquatting and brand impersonation using Levenshtein distance. Use for proactive phishing domain detection and certificate monitoring."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills",
      "path": "skills/analyzing-tls-certificate-transparency-logs/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/analyzing-tls-certificate-transparency-logs/SKILL.md",
      "key": "mukul975/anthropic-cybersecurity-skills/skills/analyzing-tls-certificate-transparency-logs/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Analyzing TLS Certificate Transparency Logs\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing tls certificate transparency logs\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Familiarity with security operations concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for a",
  "cost": {
    "context_tokens": 397
  }
}

Fetch it by URL: GET /api/v1/registry/mukul975-anthropic-cybersecurity-skills-analyzing-tls-ce-68a7d8/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.