Download

Skill UI

Browse and discover 6044+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search Event Detection , found 21 results

Default Newest Most Downloaded

Performance Bottleneck Detection

detecting-performance-bottlenecks

jeremylongshore/claude-code-plugins-plus-skills

Analyzes CPU, memory, I/O, and database traces to find and fix bottlenecks, offering remediation strategies when diagnosing slow applications, optimizing resource use, or preventing performance issues.

PowerShell Empire Detection

analyzing-powershell-empire-artifacts

mukul975/Anthropic-Cybersecurity-Skills

Scans Windows Script Block and Module Logging events to spot PowerShell Empire launchers, Base64 loaders, staging URLs, user agents, and module invocations so threat hunters can flag persistence or C2 activity quickly.

Splunk Windows Threat Detection

analyzing-windows-event-logs-in-splunk

mukul975/Anthropic-Cybersecurity-Skills

Runs SPL queries against Windows Security, System, and Sysmon logs in Splunk to flag authentication attacks, privilege escalations, persistence, and lateral movement, helping SOC analysts, detection engineers, and responders build investigations and timelines.

Splunk SPL Detection Rules

building-detection-rule-with-splunk-spl

mukul975/Anthropic-Cybersecurity-Skills

Guide for building Splunk Search Processing Language correlation searches that identify SOC threats, enrich events, configure notable alerts, and close MITRE ATT&CK coverage gaps in Enterprise Security deployments.

QRadar Event Correlation

correlating-security-events-in-qradar

mukul975/Anthropic-Cybersecurity-Skills

Guides SOC analysts and detection engineers through using IBM QRadar SIEM’s AQL queries, building blocks, reference sets, and correlation rules to link network, endpoint, and application logs for multi-stage attack detection and false-positive tuning.

ARP Poisoning Detection

detecting-arp-poisoning-in-network-traffic

mukul975/Anthropic-Cybersecurity-Skills

Use ARPWatch, Dynamic ARP Inspection, Wireshark filters, and Python monitoring scripts to detect and block ARP spoofing in sensitive LAN segments, preventing man-in-the-middle interception.

GuardDuty Cloud Threat Detection

detecting-cloud-threats-with-guardduty

mukul975/Anthropic-Cybersecurity-Skills

Guides security teams through deploying Amazon GuardDuty with protection plans for S3, EKS, EC2 runtime monitoring, and Lambda, interpreting findings, and wiring EventBridge plus Lambda for automated responses across AWS accounts.

Credential Dumping Detection

detecting-credential-dumping-techniques

mukul975/Anthropic-Cybersecurity-Skills

Implements detection coverage for LSASS credential dumping by correlating Sysmon Event ID 10 ProcessAccess logs, Windows Security process creations, and SIEM rules to highlight reg.exe/ntdsutil/comsvcs abuses plus MITRE mapping such as T1003 for analyst triage.

Golden Ticket Detection

detecting-golden-ticket-forgery

mukul975/Anthropic-Cybersecurity-Skills

Detect Kerberos Golden Ticket forgery by analyzing Windows Event IDs 4768/4769 for RC4 downgrades, ticket lifetime violations, and krbtgt anomalies across Splunk or Elastic SIEM, producing risk-scored JSON reports tied to MITRE ATT&CK mapping.

LOLBA Detection Playbook

detecting-living-off-the-land-with-lolbas

mukul975/Anthropic-Cybersecurity-Skills

Detect abuse of Living Off the Land binaries such as certutil, regsvr32, mshta, and rundll32 by ingesting Sysmon and Windows event telemetry, generating Sigma rules, and analyzing parent-child process chains to score alerts and report MITRE ATT&CK mappings.

Sysmon Scheduled Task Detection

detecting-malicious-scheduled-tasks-with-sysmon

mukul975/Anthropic-Cybersecurity-Skills

Detects malicious scheduled task creation and modification by correlating Sysmon IDs 1 and 11 with Windows Event 4698/4702, highlighting persistence hunting, suspicious parent processes, public paths, and encoded commands when tracking T1053.005 activity.

Detecting Pass-The-Ticket

detecting-pass-the-ticket-attacks

mukul975/Anthropic-Cybersecurity-Skills

Analyze Windows Event IDs 4768, 4769, and 4771 within Splunk or Elastic SIEM to identify anomalous Kerberos ticket usage, RC4 downgrades, and unusual service requests, enabling proactive Pass-the-Ticket threat detection.

Language