How do I install the D3fend Restore skill?

Run npx skillmds@latest add daemon-blockint-tech/d3fend-restore in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is D3fend Restore safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with D3fend Restore?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is D3fend Restore free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published D3fend Restore?

daemon-blockint-tech (@daemon-blockint-tech) published this skill. Their other Agent Skills are listed on their SkillMD profile.

D3fend Restore by daemon-blockint-tech

Name: D3fend Restore
Author: daemon-blockint-tech

D3fend Restore

Guides cybersecurity restoration using MITRE D3FEND—recovering access, objects, configurations, and systems after incidents. Covers credential reissuance, account unlocking, file restoration, database recovery, configuration rebuild, and software reinstallation. Use after incident containment for business continuity, disaster recovery, and return to normal operations—not for incident containment (d3fend-evict), detection (d3fend-detect), or hardening (d3fend-harden).

File contents

D3FEND — Restore

When to Use

Restoring user access after incident containment (reissue credentials, unlock accounts)
Recovering files, databases, and configurations from backup
Rebuilding systems from disk images or clean baselines
Restoring email and software after malware removal
Validating restored systems before returning to production
Documenting recovery actions for post-incident review

When NOT to Use

Active incident containment or eviction → d3fend-evict
Detection engineering or monitoring → d3fend-detect
Hardening to prevent future incidents → d3fend-harden
Backup strategy design → infrastructure-engineer
Business continuity planning → cybersecurity

Core Workflows

1. Restore Access

Action	Steps
Reissue credential	Generate new token/cert/password; distribute securely
Unlock account	Verify identity; reset MFA if compromised
Restore network access	Re-enable firewall rules; verify no persistence
Restore user account access	Validate AD/Azure AD; check group memberships

See references/restore_access.md

2. Restore Objects

Restore file (from backup, shadow copy, or clean source)
Restore email (from archive or backup)
Restore database (point-in-time recovery, transaction log replay)
Restore disk image (bare metal restore, VM snapshot)
Restore configuration (from version control or backup)

See references/restore_objects.md

3. Restore Software & Systems

Reinstall software from trusted source
Rebuild system from hardened gold image
Verify integrity (hash check, signature validation)
Re-apply patches and updates
Re-run vulnerability scan before rejoining network

See references/restore_systems.md

When to load references

Restore access → references/restore_access.md
Restore objects → references/restore_objects.md
Restore systems → references/restore_systems.md

---name: d3fend-restoredescription: Guides cybersecurity restoration using MITRE D3FEND—recovering access, objects, configurations, and systems after incidents. Covers credential reissuance, account unlocking, file restoration, database recovery, configuration rebuild, and software reinstallation. Use after incident containment for business continuity, disaster recovery, and return to normal operations—not for incident containment (d3fend-evict), detection (d3fend-detect), or hardening (d3fend-harden).---# D3FEND — Restore## When to Use- Restoring user access after incident containment (reissue credentials, unlock accounts)- Recovering files, databases, and configurations from backup- Rebuilding systems from disk images or clean baselines- Restoring email and software after malware removal- Validating restored systems before returning to production- Documenting recovery actions for post-incident review## When NOT to Use- Active incident containment or eviction → `d3fend-evict`- Detection engineering or monitoring → `d3fend-detect`- Hardening to prevent future incidents → `d3fend-harden`- Backup strategy design → `infrastructure-engineer`- Business continuity planning → `cybersecurity`## Core Workflows### 1. Restore Access| Action | Steps ||---|---|| Reissue credential | Generate new token/cert/password; distribute securely || Unlock account | Verify identity; reset MFA if compromised || Restore network access | Re-enable firewall rules; verify no persistence || Restore user account access | Validate AD/Azure AD; check group memberships |**See `references/restore_access.md`**### 2. Restore Objects- Restore file (from backup, shadow copy, or clean source)- Restore email (from archive or backup)- Restore database (point-in-time recovery, transaction log replay)- Restore disk image (bare metal restore, VM snapshot)- Restore configuration (from version control or backup)**See `references/restore_objects.md`**### 3. Restore Software & Systems- Reinstall software from trusted source- Rebuild system from hardened gold image- Verify integrity (hash check, signature validation)- Re-apply patches and updates- Re-run vulnerability scan before rejoining network**See `references/restore_systems.md`**## When to load references- **Restore access** → `references/restore_access.md`- **Restore objects** → `references/restore_objects.md`- **Restore systems** → `references/restore_systems.md`

Frequently asked questions