Download

Skill UI

Browse and discover 5987+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search Process-Detection , found 21 results

Default Newest Most Downloaded

Rootkit Activity Detection

detecting-rootkit-activity

mukul975/Anthropic-Cybersecurity-Skills

Detects stealthy rootkit behavior on compromised hosts by using memory forensics, cross-view process comparisons, kernel hook scanning, module validation, and hidden artifact discovery to confirm kernel-level compromise before remediation.

WAF SQLi Detection

detecting-sql-injection-via-waf-logs

mukul975/Anthropic-Cybersecurity-Skills

Processes ModSecurity/AWS Cloudflare WAF logs to surface SQL injection campaigns, spotting UNION SELECT/OR 1=1/SLEEP payloads, clustering attacker IPs, correlating multi-stage requests, and issuing OWASP-classified incident reports.

EDR Credential Dumping Detection

detecting-t1003-credential-dumping-with-edr

mukul975/Anthropic-Cybersecurity-Skills

Detects credential dumping T1003 activity by correlating EDR telemetry, Sysmon process access, and Windows security events to flag suspicious LSASS, SAM, NTDS, and cached credential access, guiding SOCs through containment and lateral movement analysis.

Sysmon Injection Detection

detecting-t1055-process-injection-with-sysmon

mukul975/Anthropic-Cybersecurity-Skills

Detects MITRE T1055 process injection techniques by correlating Sysmon events for remote thread creation, suspicious process access, anomalous DLL loading, and process hollowing to validate detections and feed SIEM alerts in threat-hunting workflows.

Elevation Control Abuse Detection

detecting-t1548-abuse-elevation-control-mechanism

mukul975/Anthropic-Cybersecurity-Skills

Detect T1548 elevation control abuse by monitoring UAC bypass registry tweaks, auto-elevating binaries, process integrity jumps, and Linux setuid/sudo misuse, enabling threat hunters to spot credential-free privilege escalation chains across Windows and Linux.

Comprehensive Red Team Ops

executing-red-team-exercise

mukul975/Anthropic-Cybersecurity-Skills

Simulates real-world adversary operations across people, processes, and technology by running full-scope red team exercises that stealthily work through reconnaissance, intrusion, post-exploitation, and objective completion to validate detection, response, and resilience.

LOLBin Execution Hunting

hunting-for-lolbins-execution-in-endpoint-logs

mukul975/Anthropic-Cybersecurity-Skills

Analyzes endpoint process logs to spot malicious use of legitimate Windows binaries, guiding hunters through watchlists, unusual argument detection, parent-child correlation, and scoring steps for LOLBin-based campaigns.

LOLBAS Detection Rules

hunting-living-off-the-land-binaries

mukul975/Anthropic-Cybersecurity-Skills

Monitors Windows process creation events to flag Living Off The Land Binary abuse by matching Event ID 4688/Sysmon 1 logs against LOLBAS database entries, supporting threat hunting and SIEM rule creation for fileless attacks.

MITRE ATT&CK Coverage Mapping

implementing-mitre-attack-coverage-mapping

mukul975/Anthropic-Cybersecurity-Skills

Provides SOC teams with a structured process to map detection rules to MITRE ATT&CK techniques, highlight gaps, score maturity, and prioritize rule development for better SIEM coverage.

Language