Download

Skill UI

Browse and discover 6044+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search EDR , found 19 results

Default Newest Most Downloaded

OneDrive Automation Toolkit

one-drive-automation

davepoon/buildwithclaude

Automate OneDrive file management tasks through Composio's Rube MCP toolkit, handling uploads, downloads, search, sharing links, permissions, and folder navigation via documented tool sequences once the MCP connection is active.

Bootkit Rootkit Analysis

analyzing-bootkit-and-rootkit-samples

mukul975/Anthropic-Cybersecurity-Skills

Analyzes bootkits and rootkits that hijack the MBR/VBR or UEFI to persist below the OS, guiding firmware acquisition, signature comparison, and detection when AV/EDR miss pre-boot implants.

Insider Threat Detection

detecting-insider-threat-behaviors

mukul975/Anthropic-Cybersecurity-Skills

Detects insider threat behaviors by hunting for unusual data access, privilege abuse, mass downloads, and resignation-linked exfiltration across EDR, SIEM, and intelligence sources to guide incident response actions.

Kerberoasting Detection Guide

detecting-kerberoasting-attacks

mukul975/Anthropic-Cybersecurity-Skills

Documented workflow for hunting Kerberoasting activity by correlating SIEM and EDR telemetry, validating findings, and reporting observations so defenders can proactively detect Credential Access abuse.

Mimikatz Execution Detection

detecting-mimikatz-execution-patterns

mukul975/Anthropic-Cybersecurity-Skills

Detect execution patterns of Mimikatz by correlating command-line signatures, LSASS access anomalies, binary indicators, and in-memory modules across EDR and SIEM telemetry, supporting proactive threat hunting and incident response.

Pass The Hash Detection

detecting-pass-the-hash-attacks

mukul975/Anthropic-Cybersecurity-Skills

Detecting Pass-the-Hash attacks by correlating NTLM Type 3 logons, telemetry from EDR/SIEM, and credential-dumping IOCs to proactively hunt and validate incidents across Windows estates.

Privilege Escalation Detection

detecting-privilege-escalation-attempts

mukul975/Anthropic-Cybersecurity-Skills

Workflow for hunting privilege escalation attempts across Windows and Linux, leveraging EDR/SIEM telemetry to identify token manipulation, UAC bypasses, unquoted service paths, kernel exploits, and sudo/doas abuse.

Process Injection Detection

detecting-process-injection-techniques

mukul975/Anthropic-Cybersecurity-Skills

Detects malicious process injection techniques through memory forensics, Sysmon/API monitoring, and behavioral signals, aiding EDR/SIEM teams in spotting DLL injection, hollowing, APC/thread hijacking, reflective loading, and similar stealthy attacks.

Service Account Abuse Detection

detecting-service-account-abuse

mukul975/Anthropic-Cybersecurity-Skills

Provides a detection workflow for service account abuse by leveraging EDR and SIEM telemetry to hunt for anomalous logons, lateral movement, privilege escalation, and unauthorized access, aiding proactive hunting, incident response, and purple team exercises.

Suspicious PowerShell Detection

detecting-suspicious-powershell-execution

mukul975/Anthropic-Cybersecurity-Skills

Hunts suspicious PowerShell executions by spotting encoded commands, macro-triggered download cradles, AMSI bypass attempts, and constrained language evasion across EDR and SIEM telemetry, tying results back to MITRE T1059 in proactive detection or incident-response workflows.

EDR Credential Dumping Detection

detecting-t1003-credential-dumping-with-edr

mukul975/Anthropic-Cybersecurity-Skills

Detects credential dumping T1003 activity by correlating EDR telemetry, Sysmon process access, and Windows security events to flag suspicious LSASS, SAM, NTDS, and cached credential access, guiding SOCs through containment and lateral movement analysis.

Active Directory Attack Simulation

executing-active-directory-attack-simulation

mukul975/Anthropic-Cybersecurity-Skills

Simulates authorized Active Directory attack paths using BloodHound, Mimikatz, Impacket and related tools to surface misconfigurations, weak credentials, Kerberos flaws and privilege paths before adversaries exploit them; ideal for AD pentests, SOC/EDR validation, and privilege escalation resistance checks.

Language