Download

Skill UI

Browse and discover 7115+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search Threat-Detection , found 37 results

Default Newest Most Downloaded

Container Drift Runtime Detection

detecting-container-drift-at-runtime

mukul975/Anthropic-Cybersecurity-Skills

Detecting runtime container drift by tracking unauthorized binaries, filesystem writes, package installs, and configuration deviations from original images, enabling SOC analysts to hunt threats and validate Kubernetes workload integrity with tools like Falco.

Endpoint Evasion Detection

detecting-evasion-techniques-in-endpoint-logs

mukul975/Anthropic-Cybersecurity-Skills

Detect defense-evasion techniques in endpoint logs by identifying log tampering, timestomping, process injection, security-tool disabling, and masquerading; use in threat hunting, detection engineering, or investigations that query telemetry from Sysmon, SIEM, or EDR.

Detecting Insider Threats

detecting-insider-threat-behaviors

mukul975/Anthropic-Cybersecurity-Skills

Detects insider threat behaviors such as unusual data access, off-hour activity, mass downloads, privilege abuse, and resignation-linked data theft by hunting through SIEM/EDR telemetry and threat intel to support proactive detection and incident response.

Mimikatz Execution Detection

detecting-mimikatz-execution-patterns

mukul975/Anthropic-Cybersecurity-Skills

Guides threat hunters through proactive detection of Mimikatz execution by correlating command-line signatures, LSASS access, binaries, and in-memory artifacts across EDR and SIEM telemetry.

Zeek Network Anomaly Detection

detecting-network-anomalies-with-zeek

mukul975/Anthropic-Cybersecurity-Skills

Deploy Zeek to passively observe traffic, emit structured logs, and apply bespoke detection scripts for threat hunting, incident response, and monitoring anomalous network behavior.

Pass Hash Attack Detection

detecting-pass-the-hash-attacks

mukul975/Anthropic-Cybersecurity-Skills

Detects Pass-the-Hash attacks by analyzing NTLM logon patterns and correlating credential dumping telemetry via SIEM/EDR hunting, aiding proactive threat hunting, incident response, and purple-team exercises.

Kubernetes Privilege Escalation Detection

detecting-privilege-escalation-in-kubernetes-pods

mukul975/Anthropic-Cybersecurity-Skills

Monitors Kubernetes pods for privilege escalation by combining admission controls (Pod Security Admission, OPA Gatekeeper) with Falco runtime rules on capabilities, setuid binaries, and namespace usage so SOC analysts can block risky containers and hunt threats.

Process Injection Detection

detecting-process-injection-techniques

mukul975/Anthropic-Cybersecurity-Skills

Detects and analyzes malware process injection techniques through memory forensics, API monitoring, and behavioral cues, supporting analysts working EDR/SIEM alerts and in-memory threat hunts.

Network Ransomware Early Detection

detecting-ransomware-precursors-in-network

mukul975/Anthropic-Cybersecurity-Skills

Detects pre-encryption ransomware activity across network traffic using Zeek, Suricata, Arkime, SIEM rules, and threat feeds to flag IAB behavior, Cobalt Strike beacons, credential harvesting, and staging before damage occurs.

Service Account Abuse Detection

detecting-service-account-abuse

mukul975/Anthropic-Cybersecurity-Skills

Structured threat-hunting workflow that detects anomalous service-account logons, lateral movement, and privilege escalation by guiding analysts through hypothesis formation, SIEM/EDR querying, correlation and validation for proactive response.

Malware IOC Extraction

extracting-iocs-from-malware-samples

mukul975/Anthropic-Cybersecurity-Skills

Extracts hashes, network artifacts, host indicators, and behavioral clues from malware samples to share threat intelligence and seed detection content such as YARA rules or IDS signatures.

LOLBAS Detection Rules

hunting-living-off-the-land-binaries

mukul975/Anthropic-Cybersecurity-Skills

Monitors Windows process creation events to flag Living Off The Land Binary abuse by matching Event ID 4688/Sysmon 1 logs against LOLBAS database entries, supporting threat hunting and SIEM rule creation for fileless attacks.

Prev 123 4 Next

Language