Download

Skill UI

Browse and discover 6556+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search Threat-Detection , found 40 results

Default Newest Most Downloaded

Yara Rule Authoring

sickn33/antigravity-awesome-skills

Yara Authoring helps security teams write precise YARA rules for threat detection and malware hunting by guiding string/tag management and metadata handling so signature creation keeps pace with investigations.

AD ACL Analyzer

analyzing-active-directory-acl-abuse

mukul975/Anthropic-Cybersecurity-Skills

Uses ldap3 to connect to a Domain Controller, parse ACLs via nTSecurityDescriptor/SDDL, and flag non-admin principals granted GenericAll, WriteDACL, WriteOwner, or other dangerous permissions for SOC detection and threat hunting.

API Gateway Threat Detection

analyzing-api-gateway-access-logs

mukul975/Anthropic-Cybersecurity-Skills

Parses API gateway logs (AWS, Kong, Nginx) via pandas to surface BOLA/IDOR scans, injection attempts, rate-limit bypasses, and credential scanning spikes, supporting SOC incident response and API threat rule building.

MITRE Navigator APT Heatmaps

analyzing-apt-group-with-mitre-navigator

mukul975/Anthropic-Cybersecurity-Skills

Automate ATT&CK data queries and MITRE Navigator layer creation to visualize APT group techniques, compare overlays, and expose detection gaps for threat-informed defense.

Analyzing C2 Communication

analyzing-command-and-control-communication

mukul975/Anthropic-Cybersecurity-Skills

Analyzes malware command-and-control protocols, beacon patterns, decoding logic, and infrastructure to support detection and threat intelligence workflows.

Kubernetes Audit Threat Detection

analyzing-kubernetes-audit-logs

mukul975/Anthropic-Cybersecurity-Skills

Parse Kubernetes API server audit logs to flag exec-into-pod, secret access, RBAC changes, privileged pod creations, and anonymous API calls, enabling SOC analysts to hunt threats or build SIEM rules for compromised clusters.

URLScan Malicious Analysis

analyzing-malicious-url-with-urlscan

mukul975/Anthropic-Cybersecurity-Skills

Guides analysts to use URLScan.io web and API interfaces to safely inspect phishing URLs, collect screenshots, DOM/network logs, extract IOCs, and correlate findings with threat intelligence while building detection and response workflows.

Malpedia Malware Relationships

analyzing-malware-family-relationships-with-malpedia

mukul975/Anthropic-Cybersecurity-Skills

Query Malpedia’s API to enumerate malware families, map lineage relationships, extract YARA rules, and connect families to threat actors so analysts can track variants and validate detection coverage.

Supply Chain Malware Analysis

analyzing-supply-chain-malware-artifacts

mukul975/Anthropic-Cybersecurity-Skills

Investigates supply chain attack artifacts such as trojanized updates, compromised build pipelines, and sideloaded dependencies to identify intrusion vectors, scope of compromise, and prepare IOC-based detection or threat hunting workflows.

Mapping Threat Actor Techniques

analyzing-threat-actor-ttps-with-mitre-attack

mukul975/Anthropic-Cybersecurity-Skills

Guided workflow for analysts to map threat actor behaviors to MITRE ATT&CK, visualize coverage with ATT&CK Navigator layers, identify detection gaps, and generate actionable intelligence reports leveraging attackcti, stix2, and Navigator tooling.

Threat Actor TTP Mapping

analyzing-threat-actor-ttps-with-mitre-navigator

mukul975/Anthropic-Cybersecurity-Skills

Generate MITRE ATT&CK Navigator layers for threat actor TTPs using attackcti STIX queries; visualize technique coverage, compare adversary profiles, and highlight defensive gaps when triaging incidents or planning detection and hunting work.

Cloud SIEM With Sentinel

building-cloud-siem-with-sentinel

mukul975/Anthropic-Cybersecurity-Skills

Deploy Microsoft Sentinel as a cloud-native SIEM/SOAR platform for centralized operations across AWS, Azure, and GCP; configure data connectors for multi-cloud log ingestion, author KQL detection rules, automate Logic Apps response playbooks, and hunt threats over petabyte-scale telemetry.

Language