Download

Skill UI

Browse and discover 6051+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search Proactive Detection , found 10 results

Default Newest Most Downloaded

Threat Hunt Hypothesis

building-threat-hunt-hypothesis-framework

mukul975/Anthropic-Cybersecurity-Skills

Establishes a systematic process that turns threat intelligence, ATT&CK gaps, and telemetry into testable hunting hypotheses, guiding analysts through data selection, query execution, and reporting for proactive detection and response.

Kerberoasting Detection Guide

detecting-kerberoasting-attacks

mukul975/Anthropic-Cybersecurity-Skills

Documented workflow for hunting Kerberoasting activity by correlating SIEM and EDR telemetry, validating findings, and reporting observations so defenders can proactively detect Credential Access abuse.

Mimikatz Execution Detection

detecting-mimikatz-execution-patterns

mukul975/Anthropic-Cybersecurity-Skills

Detect execution patterns of Mimikatz by correlating command-line signatures, LSASS access anomalies, binary indicators, and in-memory modules across EDR and SIEM telemetry, supporting proactive threat hunting and incident response.

Pass The Hash Detection

detecting-pass-the-hash-attacks

mukul975/Anthropic-Cybersecurity-Skills

Detecting Pass-the-Hash attacks by correlating NTLM Type 3 logons, telemetry from EDR/SIEM, and credential-dumping IOCs to proactively hunt and validate incidents across Windows estates.

Detecting Pass-The-Ticket

detecting-pass-the-ticket-attacks

mukul975/Anthropic-Cybersecurity-Skills

Analyze Windows Event IDs 4768, 4769, and 4771 within Splunk or Elastic SIEM to identify anomalous Kerberos ticket usage, RC4 downgrades, and unusual service requests, enabling proactive Pass-the-Ticket threat detection.

Service Account Abuse Detection

detecting-service-account-abuse

mukul975/Anthropic-Cybersecurity-Skills

Provides a detection workflow for service account abuse by leveraging EDR and SIEM telemetry to hunt for anomalous logons, lateral movement, privilege escalation, and unauthorized access, aiding proactive hunting, incident response, and purple team exercises.

Suspicious PowerShell Detection

detecting-suspicious-powershell-execution

mukul975/Anthropic-Cybersecurity-Skills

Hunts suspicious PowerShell executions by spotting encoded commands, macro-triggered download cradles, AMSI bypass attempts, and constrained language evasion across EDR and SIEM telemetry, tying results back to MITRE T1059 in proactive detection or incident-response workflows.

Living Off-the-Land Hunt

hunting-for-living-off-the-land-binaries

mukul975/Anthropic-Cybersecurity-Skills

Proactively hunt for adversary abuse of legitimate system binaries (LOLBins) by analyzing EDR/SIEM telemetry, correlating network activity, and documenting findings to inform detections for defense-evasion scenarios.

Spearphishing Threat Hunt

hunting-for-spearphishing-indicators

mukul975/Anthropic-Cybersecurity-Skills

Guide on hunting spearphishing indicators across email logs, endpoint telemetry, and network data with workflows, tools, scenarios, and output formats for proactive campaign detection and response.

Threat Hunting with Elastic

performing-threat-hunting-with-elastic-siem

mukul975/Anthropic-Cybersecurity-Skills

Proactively hunt threats in Elastic Security SIEM with KQL/EQL queries, Timeline investigations, and detection rules, helping SOC teams validate ATT&CK techniques, investigate anomalies, and close coverage gaps when automated alerts miss adversaries.

1

Language