Download

Skill UI

Browse and discover 6152+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search Mitre , found 34 results

Default Newest Most Downloaded

Evasion Detection Toolkit

detecting-evasion-techniques-in-endpoint-logs

mukul975/Anthropic-Cybersecurity-Skills

Guides security analysts through endpoint log use cases for detecting defense evasion tactics such as log tampering, timestomping, process injection, masquerading, LOLBin abuse, and security tool disabling to support hunting, rule development, and investigation aligned with MITRE ATT&CK TA0005.

Golden Ticket Forgery Detection

detecting-golden-ticket-forgery

mukul975/Anthropic-Cybersecurity-Skills

Detects Golden Ticket forgery by analyzing Windows Event IDs 4768/4769 for RC4 downgrades, orphaned TGS requests, excessive ticket lifetimes, and krbtgt anomalies in Splunk or Elastic SIEM, producing MITRE-mapped risk reports.

Lateral Movement Detection

detecting-lateral-movement-in-network

mukul975/Anthropic-Cybersecurity-Skills

Analyzes authentication logs, SMB flows, RDP sessions, and Zeek data to spot MITRE ATT&CK lateral movement techniques, powering SIEM alerts, hunting, and post-compromise investigations in enterprise networks.

Suspicious PowerShell Detection

detecting-suspicious-powershell-execution

mukul975/Anthropic-Cybersecurity-Skills

Hunts suspicious PowerShell executions by spotting encoded commands, macro-triggered download cradles, AMSI bypass attempts, and constrained language evasion across EDR and SIEM telemetry, tying results back to MITRE T1059 in proactive detection or incident-response workflows.

Sysmon Injection Detection

detecting-t1055-process-injection-with-sysmon

mukul975/Anthropic-Cybersecurity-Skills

Detects MITRE T1055 process injection techniques by correlating Sysmon events for remote thread creation, suspicious process access, anomalous DLL loading, and process hollowing to validate detections and feed SIEM alerts in threat-hunting workflows.

Advanced Threat Hunting

hunting-advanced-persistent-threats

mukul975/Anthropic-Cybersecurity-Skills

Hunt for Advanced Persistent Threats across endpoints, network logs, and memory using MITRE ATT&CK hypotheses, Velociraptor/osquery queries, and SIEM pivots to validate threats or gaps before escalation.

Data Staging Hunt

hunting-for-data-staging-before-exfiltration

mukul975/Anthropic-Cybersecurity-Skills

Detects data-staging activity prior to exfiltration by tracking archive tool execution, staging directories, large file consolidations, and sensitive path access via EDR/Sysmon telemetry; outputs risk scores, archive timelines, and MITRE ATT&CK mappings for hunters.

Domain Fronting Detection

hunting-for-domain-fronting-c2-traffic

mukul975/Anthropic-Cybersecurity-Skills

Detect domain fronting C2 traffic by correlating proxy SNI vs HTTP Host mismatches, TLS certificate issuers, and CDN IP ranges, then scoring alerts for MITRE ATT&CK T1090.004 investigations.

Registry Run Key Hunting

hunting-for-registry-run-key-persistence

mukul975/Anthropic-Cybersecurity-Skills

Guides threat hunters through analyzing Sysmon Event ID 13 and related events to detect MITRE ATT&CK T1547.001 registry Run key persistence, highlighting suspicious paths, LOLBin usage, encoded scripts, and how to escalate findings into Sigma/Splunk rules.

Hunt Unusual Service Installs

hunting-for-unusual-service-installations

mukul975/Anthropic-Cybersecurity-Skills

Detect suspicious Windows service installations by parsing System event logs for Event ID 7045, analyzing service binaries and paths, and highlighting persistence indicators tied to MITRE ATT&CK T1543.003 for focused SOC response.

Continuous Security Validation

implementing-continuous-security-validation-with-bas

mukul975/Anthropic-Cybersecurity-Skills

Deploy Breach and Attack Simulation (BAS) platforms to continuously exercise MITRE ATT&CK techniques across production defenses, revealing control gaps in endpoints, networks, email, SIEM, and response workflows before real adversaries arrive.

MITRE ATT&CK Coverage Mapping

implementing-mitre-attack-coverage-mapping

mukul975/Anthropic-Cybersecurity-Skills

Guide SOC teams through MITRE ATT&CK coverage mapping to spot detection gaps, prioritize rule development, and measure SOC maturity against adversary techniques using SIEM exports, coverage matrices, and scoring rubrics.

Language