Download

Skill UI

Browse and discover 6280+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search edr , found 21 results

Default Newest Most Downloaded

OneDrive Automation Toolkit

one-drive-automation

davepoon/buildwithclaude

Automate OneDrive file management tasks through Composio's Rube MCP toolkit, handling uploads, downloads, search, sharing links, permissions, and folder navigation via documented tool sequences once the MCP connection is active.

Threat Feed Analysis

analyzing-threat-intelligence-feeds

mukul975/Anthropic-Cybersecurity-Skills

Analyzes structured and unstructured threat intelligence feeds, normalizes IOCs into STIX 2.1, enriches them with context, and distributes vetted indicators to SIEM/EDR tooling when ingesting commercial or OSINT sources.

Endpoint Evasion Detection

detecting-evasion-techniques-in-endpoint-logs

mukul975/Anthropic-Cybersecurity-Skills

Detects adversary defense-evasion techniques in endpoint logs, covering log tampering, timestomping, process injection, and security tool disabling; useful for threat hunting, detection engineering, and incident response on Windows/EDR telemetry.

Insider Threat Detection

detecting-insider-threat-behaviors

mukul975/Anthropic-Cybersecurity-Skills

Proactively hunts for insider threat indicators by correlating SIEM and EDR telemetry, validating hypotheses from threat intelligence, and documenting detection findings to guide response during campaigns that feature unauthorized data access, privilege abuse, or resignation-related exfiltration.

Living Off The Land Detection

detecting-living-off-the-land-attacks

mukul975/Anthropic-Cybersecurity-Skills

Detect suspicious use of legitimate Windows binaries to surface living-off-the-land attacks by correlating Sysmon process/network events, SIEM/Sigma rules, and telemetry; ideal for crafting detection rules, hunting fileless threats, and tuning whitelists or incident responses.

Privilege Escalation Detection

detecting-privilege-escalation-attempts

mukul975/Anthropic-Cybersecurity-Skills

Provides a structured hunt process for detecting privilege escalation attempts on Windows and Linux by aligning hypotheses, telemetry selection, query execution, and validation across EDR, SIEM, and threat intelligence sources.

Process Injection Detection

detecting-process-injection-techniques

mukul975/Anthropic-Cybersecurity-Skills

Analyzes malware process injection techniques across DLL injection, hollowing, APC, thread hijacking, and reflective loading using memory forensics, API monitoring, and Sysmon data to help EDR/SIEM detection.

EDR Credential Dump Detection

detecting-t1003-credential-dumping-with-edr

mukul975/Anthropic-Cybersecurity-Skills

Uses EDR telemetry, Sysmon and Defender logs to detect T1003 credential dumping targeting LSASS memory, SAM, NTDS, cached credentials, and DCSync activity, helping hunters map suspicious access, lateral movement, and impacted accounts.

Detect Data Staging

hunting-for-data-staging-before-exfiltration

mukul975/Anthropic-Cybersecurity-Skills

Detect adversary staging before exfiltration by watching for archive tool execution, anomalous temp directory writes, large-file consolidation and suspicious staging paths in EDR/Sysmon telemetry, then score and report events.

Living Off-the-Land Hunting

hunting-for-living-off-the-land-binaries

mukul975/Anthropic-Cybersecurity-Skills

Proactive threat-hunting workflow that tracks living-off-the-land binaries through EDR/SIEM telemetry, defines hypotheses, baselines normal use, correlates anomalies, and documents detections for defense evasion coverage.

LOLBin Execution Hunting

hunting-for-lolbins-execution-in-endpoint-logs

mukul975/Anthropic-Cybersecurity-Skills

Analyze endpoint process creation logs to hunt for adversarial abuse of Living Off the Land binaries by profiling command lines, parent chains, file paths, and network links across Sysmon, EDR, and SIEM platforms.

Process Injection Hunting

hunting-for-process-injection-techniques

mukul975/Anthropic-Cybersecurity-Skills

Hunt for process injection techniques using Sysmon Event IDs 1, 8, and 10 plus EDR telemetry; flag CreateRemoteThread, inspect ProcessAccess rights, build graphs, score severity, and report T1055 insights.

Language