Download

Skill UI

Browse and discover 6191+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search Windows Security , found 10 results

Default Newest Most Downloaded

Splunk Windows Threat Detection

analyzing-windows-event-logs-in-splunk

mukul975/Anthropic-Cybersecurity-Skills

Runs SPL queries against Windows Security, System, and Sysmon logs in Splunk to flag authentication attacks, privilege escalations, persistence, and lateral movement, helping SOC analysts, detection engineers, and responders build investigations and timelines.

Detect Golden Ticket Attacks

detecting-golden-ticket-attacks

mukul975/Anthropic-Cybersecurity-Skills

Analyzes Windows Security EVTX logs to detect Kerberos golden ticket assaults by correlating event IDs 4768, 4624, and 4672, flagging long-lived TGTs, privilege escalations without group changes, SID inconsistencies, and outputting a timeline-based report.

Detect Malicious Scheduled Tasks

detecting-malicious-scheduled-tasks-with-sysmon

mukul975/Anthropic-Cybersecurity-Skills

Uses Sysmon and Windows security logs to spot malicious scheduled task creation by correlating Event IDs 1, 11 and 4698/4702, filtering on suspicious parents, public paths, encoded commands or remote creation, supporting detection rule development and hunting T1053.005 persistence.

Detect Pass-The-Ticket Attacks

detecting-pass-the-ticket-attacks

mukul975/Anthropic-Cybersecurity-Skills

Analyzes Windows Security events in Splunk or Elastic to surface anomalous Kerberos ticket use, highlighting RC4 downgrades, cross-host reuse, and high-volume service requests to expose Pass-the-Ticket attacks.

RDP Brute Force Detection

detecting-rdp-brute-force-attacks

mukul975/Anthropic-Cybersecurity-Skills

Detect RDP brute force attacks by analyzing Windows Security Event Logs with python-evtx, correlating Event IDs 4625 and 4624, tracking source IP frequency, and producing JSON reports that highlight top attackers and potential compromises.

EDR Credential Dumping Detection

detecting-t1003-credential-dumping-with-edr

mukul975/Anthropic-Cybersecurity-Skills

Detects credential dumping T1003 activity by correlating EDR telemetry, Sysmon process access, and Windows security events to flag suspicious LSASS, SAM, NTDS, and cached credential access, guiding SOCs through containment and lateral movement analysis.

Hardening Windows Endpoints

hardening-windows-endpoint-with-cis-benchmark

mukul975/Anthropic-Cybersecurity-Skills

Guides deploying CIS Benchmark hardening for Windows workstations and servers, covering profile selection, GPO imports, key security controls, CIS-CAT validation, and exception documentation to enforce consistent baselines and compliance.

Volatility3 Memory Forensics

performing-memory-forensics-with-volatility3-plugins

mukul975/Anthropic-Cybersecurity-Skills

Automate memory forensics on Windows, Linux, and macOS RAM dumps with Volatility3 plugins to detect injected code, hidden processes, rootkits, credential theft, and anomalous network activity, accelerating incident response and security assessments.

Active Directory Honeytoken Deployment

deploying-active-directory-honeytokens

mukul975/Anthropic-Cybersecurity-Skills

Deploy deception-based honeytokens across Active Directory by creating fake privileged accounts, SPNs, GPOs, and BloodHound paths to detect Kerberoasting, credential theft, lateral movement, and reconnaissance via monitored Windows Security events.

NTLM Relay Event Hunting

detecting-ntlm-relay-with-event-correlation

mukul975/Anthropic-Cybersecurity-Skills

Correlates Windows Security Event 4624 LogonType 3 with DNS/IP inventories, SMB/LDAP signing audits, and downgrade detection to surface NTLM relay coercion artifacts from Responder, PetitPotam, DFSCoerce, and similar tactics.

1

Language