Analyzing TLS Certificate Transparency Logs
FreeDetect phishing and unauthorized certificates proactively.
Free · Opens the source repo
What Analyzing TLS Certificate Transparency Logs does
The Analyzing TLS Certificate Transparency Logs skill enables security professionals to query and analyze Certificate Transparency (CT) logs using the crt.sh and pycrtsh libraries. This skill is particularly useful for detecting phishing domains, unauthorized certificate issuances, and shadow IT. By leveraging the Levenshtein distance algorithm, it can identify typosquatting variations that may pose risks to an organization’s brand. This proactive approach allows security operations teams to monitor newly issued certificates for potential threats, ensuring that they remain vigilant against impersonation attacks.
When utilizing this skill, users can execute Python scripts to search for certificates associated with specific domains, including variations that could indicate phishing attempts. The process involves querying the crt.sh database, identifying unexpected certificate authorities (CAs), and monitoring for wildcard certificates that could lead to security breaches. The skill is designed for SOC analysts and security teams who require structured methodologies for analyzing CT logs and validating their security monitoring coverage against various attack techniques.
To effectively use this skill, familiarity with security operations concepts and Python programming is essential. Users should have access to a test environment to safely execute their queries and analyses. The skill provides clear instructions and examples for querying the CT logs, making it accessible for those with intermediate Python skills. By integrating this tool into their security operations workflow, teams can enhance their ability to detect and respond to potential phishing threats and unauthorized certificate issuances.
When to use it
Use this skill when investigating security incidents or building detection rules related to TLS certificates.
When not to use it
Avoid this skill if you lack Python programming knowledge or do not have access to a suitable testing environment.
What you can build with it
Investigating Security Incidents
Use this skill to analyze TLS certificate logs during a security incident investigation, identifying potential phishing domains.
Building Detection Rules
Leverage this skill to create detection rules for monitoring unauthorized certificate issuance and typosquatting variations.
Validating Security Monitoring Coverage
Employ this skill to assess and validate your organization's security monitoring coverage against known phishing techniques.
How to install Analyzing TLS Certificate Transparency Logs
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/analyzing-tls-certificate-transparency-logs --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Analyzing TLS Certificate Transparency Logs
When to Use
- When investigating security incidents that require analyzing tls certificate transparency logs
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Familiarity with security operations concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
Instructions
Query crt.sh Certificate Transparency database to find certificates issued for domains similar to your organization's brand, detecting phishing infrastructure.
from pycrtsh import Crtsh
c = Crtsh()
# Search for certificates matching a domain
certs = c.search("example.com")
for cert in certs:
print(cert["id"], cert["name_value"])
# Get full certificate details
details = c.get(certs[0]["id"], type="id")
Key analysis steps:
- Query crt.sh for all certificates matching your domain pattern
- Identify certificates with typosquatting variations (Levenshtein distance)
- Flag certificates from unexpected CAs
- Monitor for wildcard certificates on suspicious subdomains
- Cross-reference with known phishing infrastructure
Examples
from pycrtsh import Crtsh
c = Crtsh()
certs = c.search("%.example.com")
for cert in certs:
print(f"Issuer: {cert.get('issuer_name')}, Domain: {cert.get('name_value')}")
Frequently asked questions about Analyzing TLS Certificate Transparency Logs
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.