Download

Skill UI

Browse and discover 6004+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search Process-Detection , found 21 results

Default Newest Most Downloaded

Domain Component Detection

component-common-domain-detection

tech-leads-club/agent-skills

Analyzes component namespaces and shared classes to surface duplicated domain logic and suggest consolidation paths before refactoring, helping identify which business processes can share services, libraries, or merged components.

Linux Audit Intrusion Detection

analyzing-linux-audit-logs-for-intrusion

mukul975/Anthropic-Cybersecurity-Skills

Parse Linux auditd logs for unauthorized file access, privilege escalation, syscall anomalies, and suspicious processes using ausearch plus Python automation.

Splunk SPL Detection Rules

building-detection-rule-with-splunk-spl

mukul975/Anthropic-Cybersecurity-Skills

Guide for building Splunk Search Processing Language correlation searches that identify SOC threats, enrich events, configure notable alerts, and close MITRE ATT&CK coverage gaps in Enterprise Security deployments.

Threat Hunt Hypothesis

building-threat-hunt-hypothesis-framework

mukul975/Anthropic-Cybersecurity-Skills

Establishes a systematic process that turns threat intelligence, ATT&CK gaps, and telemetry into testable hunting hypotheses, guiding analysts through data selection, query execution, and reporting for proactive detection and response.

Detecting SCADA Attacks

detecting-attacks-on-scada-systems

mukul975/Anthropic-Cybersecurity-Skills

Identifies cyber attacks that target SCADA/ICS environments by leveraging OT-aware intrusion detection, industrial protocol anomaly analysis, and process data baselines to spot MITM, PLC injection, historian tampering, and DoS cases that IT-focused tools miss.

Credential Dumping Detection

detecting-credential-dumping-techniques

mukul975/Anthropic-Cybersecurity-Skills

Implements detection coverage for LSASS credential dumping by correlating Sysmon Event ID 10 ProcessAccess logs, Windows Security process creations, and SIEM rules to highlight reg.exe/ntdsutil/comsvcs abuses plus MITRE mapping such as T1003 for analyst triage.

Cloud Cryptomining Detection

detecting-cryptomining-in-cloud

mukul975/Anthropic-Cybersecurity-Skills

Guides security teams through identifying unauthorized cloud cryptomining by correlating cost anomalies, GuardDuty crypto findings, network traffic to mining pools, and runtime process hooks across EC2, ECS, EKS, and Azure workloads.

Evasion Detection Toolkit

detecting-evasion-techniques-in-endpoint-logs

mukul975/Anthropic-Cybersecurity-Skills

Guides security analysts through endpoint log use cases for detecting defense evasion tactics such as log tampering, timestomping, process injection, masquerading, LOLBin abuse, and security tool disabling to support hunting, rule development, and investigation aligned with MITRE ATT&CK TA0005.

Living Off The Land Detection

detecting-living-off-the-land-attacks

mukul975/Anthropic-Cybersecurity-Skills

Detects abuse of legitimate Windows binaries by tracking process creation, command-line parameters, and parent-child relationships to flag living-off-the-land and fileless attack patterns.

LOLBA Detection Playbook

detecting-living-off-the-land-with-lolbas

mukul975/Anthropic-Cybersecurity-Skills

Detect abuse of Living Off the Land binaries such as certutil, regsvr32, mshta, and rundll32 by ingesting Sysmon and Windows event telemetry, generating Sigma rules, and analyzing parent-child process chains to score alerts and report MITRE ATT&CK mappings.

Sysmon Scheduled Task Detection

detecting-malicious-scheduled-tasks-with-sysmon

mukul975/Anthropic-Cybersecurity-Skills

Detects malicious scheduled task creation and modification by correlating Sysmon IDs 1 and 11 with Windows Event 4698/4702, highlighting persistence hunting, suspicious parent processes, public paths, and encoded commands when tracking T1053.005 activity.

Process Injection Detection

detecting-process-injection-techniques

mukul975/Anthropic-Cybersecurity-Skills

Detects malicious process injection techniques through memory forensics, Sysmon/API monitoring, and behavioral signals, aiding EDR/SIEM teams in spotting DLL injection, hollowing, APC/thread hijacking, reflective loading, and similar stealthy attacks.

Language