Download

Skill UI

Browse and discover 6044+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search incident-response , found 65 results

Default Newest Most Downloaded

Volatile Evidence Collection

collecting-volatile-evidence-from-compromised-host

mukul975/Anthropic-Cybersecurity-Skills

Guides responders through collecting memory, network, and process snapshots from compromised hosts before volatility is lost, ensuring chain-of-custody and supporting incident response plus legal follow-up.

Cloud Incident Response Manual

conducting-cloud-incident-response

mukul975/Anthropic-Cybersecurity-Skills

Guides responders through detecting, containing, and investigating AWS/Azure/GCP compromises by centralizing log analysis, isolating identities/resources, and preserving forensic evidence for fast cloud incident recovery.

GuardDuty Findings Automation

detecting-aws-guardduty-findings-automation

mukul975/Anthropic-Cybersecurity-Skills

Automates GuardDuty findings processing with EventBridge and Lambda so that high-severity threats trigger quarantines, forensic snapshots, and SNS alerts for real-time incident response.

Compromised Cloud Credentials Detection

detecting-compromised-cloud-credentials

mukul975/Anthropic-Cybersecurity-Skills

Detect compromised AWS, Azure, and GCP credentials by analyzing GuardDuty, Defender for Identity, and SCC alerts alongside log anomalies, impossible travel, and unauthorized provisioning indicators for rapid incident response.

Zeek DNS Exfiltration Detection

detecting-exfiltration-over-dns-with-zeek

mukul975/Anthropic-Cybersecurity-Skills

Analyzes Zeek dns.log data to spot DNS-based exfiltration by measuring entropy, label length, subdomain volume, and query rates, then scores and reports suspicious domains for incident response.

Insider Threat Detection

detecting-insider-threat-behaviors

mukul975/Anthropic-Cybersecurity-Skills

Detects insider threat behaviors by hunting for unusual data access, privilege abuse, mass downloads, and resignation-linked exfiltration across EDR, SIEM, and intelligence sources to guide incident response actions.

Mimikatz Execution Detection

detecting-mimikatz-execution-patterns

mukul975/Anthropic-Cybersecurity-Skills

Detect execution patterns of Mimikatz by correlating command-line signatures, LSASS access anomalies, binary indicators, and in-memory modules across EDR and SIEM telemetry, supporting proactive threat hunting and incident response.

Zeek Network Anomaly Detection

detecting-network-anomalies-with-zeek

mukul975/Anthropic-Cybersecurity-Skills

Deploys Zeek to passively monitor network traffic, emit structured connection/DNS/HTTP/SSL logs, and run custom scripts that flag anomalous behavior for threat hunting and incident response teams.

Service Account Abuse Detection

detecting-service-account-abuse

mukul975/Anthropic-Cybersecurity-Skills

Provides a detection workflow for service account abuse by leveraging EDR and SIEM telemetry to hunt for anomalous logons, lateral movement, privilege escalation, and unauthorized access, aiding proactive hunting, incident response, and purple team exercises.

Supply Chain Attack Detector

detecting-supply-chain-attacks-in-ci-cd

mukul975/Anthropic-Cybersecurity-Skills

Audits GitHub Actions workflows and CI/CD pipelines to uncover supply chain risks such as unpinned actions, expression injection, dependency confusion, and overly permissive secrets, supporting hardening efforts and incident response.

Suspicious PowerShell Detection

detecting-suspicious-powershell-execution

mukul975/Anthropic-Cybersecurity-Skills

Hunts suspicious PowerShell executions by spotting encoded commands, macro-triggered download cradles, AMSI bypass attempts, and constrained language evasion across EDR and SIEM telemetry, tying results back to MITRE T1059 in proactive detection or incident-response workflows.

Agent Tesla Config Extractor

extracting-config-from-agent-tesla-rat

mukul975/Anthropic-Cybersecurity-Skills

Extracts SMTP, FTP, Telegram, Discord, and keylogger settings from Agent Tesla RAT assemblies via .NET decompilation and automated analysis for incident response.

Prev 1 2 345 6 Next

Language