Download

Skill UI

Browse and discover 6170+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search incident-response , found 94 results

Default Newest Most Downloaded

Email Compromise Detection

detecting-email-account-compromise

mukul975/Anthropic-Cybersecurity-Skills

Detect compromised Microsoft 365 and Google Workspace mailboxes by analyzing inbox rule changes, external forwarding, anomalous sign-ins, suspicious OAuth usage, and Microsoft Graph activity to support BEC hunting and incident response.

Insider Threat Detection

detecting-insider-threat-behaviors

mukul975/Anthropic-Cybersecurity-Skills

Detects insider threat behaviors by hunting for unusual data access, privilege abuse, mass downloads, and resignation-linked exfiltration across EDR, SIEM, and intelligence sources to guide incident response actions.

Mimikatz Execution Detection

detecting-mimikatz-execution-patterns

mukul975/Anthropic-Cybersecurity-Skills

Detect execution patterns of Mimikatz by correlating command-line signatures, LSASS access anomalies, binary indicators, and in-memory modules across EDR and SIEM telemetry, supporting proactive threat hunting and incident response.

Zeek Network Anomaly Detection

detecting-network-anomalies-with-zeek

mukul975/Anthropic-Cybersecurity-Skills

Deploys Zeek to passively monitor network traffic, emit structured connection/DNS/HTTP/SSL logs, and run custom scripts that flag anomalous behavior for threat hunting and incident response teams.

Service Account Abuse Detection

detecting-service-account-abuse

mukul975/Anthropic-Cybersecurity-Skills

Provides a detection workflow for service account abuse by leveraging EDR and SIEM telemetry to hunt for anomalous logons, lateral movement, privilege escalation, and unauthorized access, aiding proactive hunting, incident response, and purple team exercises.

CI/CD Supply Chain Detection

detecting-supply-chain-attacks-in-ci-cd

mukul975/Anthropic-Cybersecurity-Skills

Inspects GitHub Actions and other CI/CD workflow files for unpinned actions, script injection patterns, token exposures, or dependency confusion to harden pipelines and aid incident response.

Suspicious PowerShell Detection

detecting-suspicious-powershell-execution

mukul975/Anthropic-Cybersecurity-Skills

Hunts suspicious PowerShell executions by spotting encoded commands, macro-triggered download cradles, AMSI bypass attempts, and constrained language evasion across EDR and SIEM telemetry, tying results back to MITRE T1059 in proactive detection or incident-response workflows.

Credential Extraction Memory Dump

extracting-credentials-from-memory-dump

mukul975/Anthropic-Cybersecurity-Skills

Use Volatility, Mimikatz, and pypykatz to recover cached credentials, hashes, and Kerberos tickets from Windows memory dumps for incident response, breach scope analysis, and forensic investigations.

Windows Event Log Forensics

extracting-windows-event-logs-artifacts

mukul975/Anthropic-Cybersecurity-Skills

Extract, parse, and analyze EVTX files with Chainsaw, Hayabusa, and EvtxECmd to uncover lateral movement, persistence, and privilege escalation during incident response and forensic investigations.

Scheduled Task Persistence Hunt

hunting-for-scheduled-task-persistence

mukul975/Anthropic-Cybersecurity-Skills

Hunt for adversary persistence via Windows Scheduled Tasks by analyzing creation events, suspicious task actions, and unusual scheduling patterns across EDR and SIEM telemetry to validate detections and inform incident response.

SOAR Automation with Phantom

implementing-soar-automation-with-phantom

mukul975/Anthropic-Cybersecurity-Skills

Automates SOC workflows with Splunk SOAR Phantom to triage alerts, enrich IOCs, orchestrate containment, and standardize analyst playbooks for faster incident response.

XSOAR SOAR Playbook Automation

implementing-soar-playbook-with-palo-alto-xsoar

mukul975/Anthropic-Cybersecurity-Skills

Automates incident response through Cortex XSOAR playbooks, chaining enrichment, decision logic, containment, and ticketing so SOC teams reduce MTTR while orchestrating multiple security tools.

Prev 1 2 3 456 7 8 Next

Language