Download

Skill UI

Browse and discover 19205+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search Windows Security , found 17 results

Default Newest Most Downloaded

Configure Advanced Windows Defender Settings

configuring-windows-defender-advanced-settings

mukul975/Anthropic-Cybersecurity-Skills

This skill provides comprehensive guidance and PowerShell scripts for hardening Windows endpoints using Microsoft Defender for Endpoint (MDE). It covers advanced features like Attack Surface Reduction (ASR) rules to block common attack techniques, Controlled Folder Access for ransomware protection, and Network Protection. Use this for deploying enterprise-grade, compliance-required security policies via Intune or Group Policy.

Detect Golden Ticket Attacks

detecting-golden-ticket-attacks

mukul975/Anthropic-Cybersecurity-Skills

Analyzes Windows Security EVTX logs to detect Kerberos golden ticket assaults by correlating event IDs 4768, 4624, and 4672, flagging long-lived TGTs, privilege escalations without group changes, SID inconsistencies, and outputting a timeline-based report.

Detecting Lateral Movement in Enterprise Networks

detecting-lateral-movement-in-network

mukul975/Anthropic-Cybersecurity-Skills

A comprehensive guide and framework for detecting attacker lateral movement within enterprise networks. It details the use of network flow analysis (Zeek), authentication log review (Windows Event Logs, Kerberos), and dedicated SIEM correlation rules (Splunk, Elastic) to identify techniques like Pass-the-Hash and RDP hopping. Ideal for threat hunters and security engineers building detection pipelines.

Detecting LOLBAS Abuse with System Monitoring

detecting-living-off-the-land-with-lolbas

mukul975/Anthropic-Cybersecurity-Skills

This skill provides a comprehensive methodology for detecting Living Off the Land Binaries (LOLBAS) abuse. It analyzes process telemetry (Sysmon, Windows Logs) and parent-child relationships to identify when attackers misuse legitimate Windows utilities (like certutil, mshta, rundll32) to execute malicious code while bypassing traditional security detection. Essential for threat hunting and advanced incident response.

Detecting Kerberos Pass-the-Ticket Attacks

detecting-pass-the-ticket-attacks

mukul975/Anthropic-Cybersecurity-Skills

This skill details the detection of Pass-the-Ticket (PtT) attacks, a critical credential theft technique. It instructs users on analyzing Windows Security Event IDs (4768, 4769, 4771) within SIEM platforms like Splunk or Elastic. Use cases include investigating security incidents, building advanced threat hunting queries, and validating SOC monitoring coverage for lateral movement attacks.

Detect RDP Brute Force Attacks

detecting-rdp-brute-force-attacks

mukul975/Anthropic-Cybersecurity-Skills

This skill provides a structured method for analyzing Windows Security Event Logs (EVTX) to detect brute force attacks targeting RDP endpoints. It involves parsing failed logon events (Event ID 4625) and correlating them with successful logons (Event ID 4624), while also analyzing source IP frequency and NLA bypass attempts. Ideal for security incident investigation, blue-team threat hunting, and building SIEM detection rules.

Detecting Registry Run Key Persistence

hunting-for-registry-run-key-persistence

mukul975/Anthropic-Cybersecurity-Skills

This guide details a threat hunting technique for detecting persistence mechanisms utilizing Windows Registry Run keys (T1547.001). By analyzing Sysmon Event ID 13 logs, it identifies suspicious auto-start entries pointing to temporary directories, encoded PowerShell commands, or abused LOLBins. Essential for SOC analysts and security engineers investigating incidents and developing robust detection rules.

Agentless Vulnerability Scanning and Assessment

performing-agentless-vulnerability-scanning

mukul975/Anthropic-Cybersecurity-Skills

This skill covers performing comprehensive vulnerability assessments across diverse environments, including on-premises infrastructure, cloud VMs, and container registries. It leverages standard network protocols like SSH (Linux) and WMI (Windows), coupled with advanced cloud provider APIs for analyzing disk snapshots without requiring local endpoint agents. Ideal for security auditing and compliance checks.

WMI Lateral Movement and Post-Exploitation

performing-lateral-movement-with-wmiexec

mukul975/Anthropic-Cybersecurity-Skills

This skill details advanced techniques for performing stealthy lateral movement across Windows domains using Windows Management Instrumentation (WMI). It covers the abuse of native tools like Impacket's wmiexec.py and CrackMapExec, enabling remote command execution, Pass-the-Hash attacks, and fileless techniques, crucial for authorized red team engagements and security auditing.

Volatility3 Memory Forensics Toolkit

performing-memory-forensics-with-volatility3-plugins

mukul975/Anthropic-Cybersecurity-Skills

This automated toolkit streamlines memory forensics using the Volatility3 framework. It is designed to analyze raw memory dumps from Windows, Linux, and macOS, revealing complex threats such as process injection, hidden rootkits, malicious code artifacts, and illicit network connections that traditional disk-based methods cannot detect. Essential for real-time incident response and deep security auditing.

Analyzing Race Condition State Drift

competition-race-condition-state-drift

zhaoxuya520/reverse-skill

A specialized skill for analyzing and reproducing complex, timing-dependent bugs in concurrent systems. Use this to investigate race windows, ordering bugs, lock gaps, stale reads, or state inconsistencies where the final outcome depends critically on request timing or asynchronous execution order. Essential for deep security auditing and debugging of distributed transactions.

Advanced Active Directory Exploitation Techniques

zhaoxuya520/reverse-skill

A comprehensive guide detailing advanced, authorized techniques for Active Directory security testing and red teaming. It covers critical attack vectors such as Kerberos exploitation, BloodHound path analysis, NTLM relay, and domain privilege escalation. Designed for security professionals to systematically map and exploit domain weaknesses.

Language