Download

Skill UI

Browse and discover 9944+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search incident-response , found 14 results

Default Newest Most Downloaded

Databricks Incident Response Runbook

databricks-incident-runbook

jeremylongshore/claude-code-plugins-plus-skills

A comprehensive runbook designed for on-call engineers to manage Databricks incidents, outages, and major job failures. It provides structured procedures for immediate triage, decision tree guidance (covering cluster failures, code errors, and data quality issues), and steps for evidence collection and postmortem documentation, ensuring rapid and systematic incident resolution.

Analyzing Browser Forensics with Hindsight

analyzing-browser-forensics-with-hindsight

mukul975/Anthropic-Cybersecurity-Skills

Hindsight is an open-source digital forensics tool designed to parse and correlate artifacts from Chromium-based browsers (Chrome, Edge, Brave, Opera). It extracts comprehensive data, including browsing history, cookies, download records, autofill data, and saved passwords, generating unified, chronological timelines essential for incident response, insider threat investigation, and digital forensics cases.

Analyzing Indicators of Compromise

analyzing-indicators-of-compromise

mukul975/Anthropic-Cybersecurity-Skills

This skill analyzes Indicators of Compromise (IOCs)—such as IP addresses, domains, and file hashes—by querying multiple threat intelligence platforms (VirusTotal, AbuseIPDB, MISP). It determines maliciousness confidence, assigns blocking priorities, and attributes threats to campaigns, crucial for incident response, threat triage, and making informed security decisions.

Analyzing Kubernetes Audit Logs for Threats

analyzing-kubernetes-audit-logs

mukul975/Anthropic-Cybersecurity-Skills

This tool parses Kubernetes API server audit logs (JSON lines) to detect critical security events. It specifically targets unauthorized access, secret enumeration, RBAC escalation, privileged pod creation, and shell access (exec/attach). Use it for incident response, threat hunting, or building SIEM detection rules.

Analyzing Threat Landscape with MISP

analyzing-threat-landscape-with-misp

mukul975/Anthropic-Cybersecurity-Skills

This tool provides comprehensive analysis of the cybersecurity threat landscape using the Malware Information Sharing Platform (MISP). It allows users to query event statistics, analyze attribute distributions (IPs, domains, hashes), identify top threat actors and malware families, and track temporal trends. It is essential for SOC analysts performing incident response, threat hunting, and building advanced detection rules.

Analyzing Windows Amcache Forensic Artifacts

analyzing-windows-amcache-artifacts

mukul975/Anthropic-Cybersecurity-Skills

A specialized tool for digital forensics investigators that parses the Windows Amcache.hve registry hive. It extracts crucial evidence regarding program execution history, application installation metadata, and loaded driver binaries. By correlating SHA-1 hashes and reconstructing timelines, users can determine which executables ran on a system, aiding in incident response and threat detection.

Analyzing Windows Prefetch Files for Forensics

analyzing-windows-prefetch-with-python

mukul975/Anthropic-Cybersecurity-Skills

This skill provides a method to parse Windows Prefetch files (.pf) using Python, allowing security analysts to reconstruct detailed application execution histories. It is crucial for incident response, enabling the detection of renamed binaries, identifying suspicious execution patterns, and building accurate chronological timelines of system activity for deep forensic investigation.

Detecting WMI Event Persistence Artifacts

detecting-wmi-persistence

mukul975/Anthropic-Cybersecurity-Skills

This guide details how to detect WMI event subscription persistence, a common attacker technique (T1546.003). It focuses on analyzing suspicious Sysmon Event IDs 19, 20, and 21 to identify malicious EventFilters, EventConsumers, and Bindings. Essential for incident response and threat hunting in Windows environments.

Analyzing Windows Event Logs for Forensics

extracting-windows-event-logs-artifacts

mukul975/Anthropic-Cybersecurity-Skills

A comprehensive workflow for extracting, parsing, and analyzing Windows Event Logs (EVTX). It guides security professionals in using advanced tools like Chainsaw and Hayabusa, combined with Sigma rules, to detect critical security incidents such as lateral movement, privilege escalation, and persistence mechanisms during incident response and digital forensic investigations.

Detecting C2 Beaconing in Network Traffic

hunting-for-command-and-control-beaconing

mukul975/Anthropic-Cybersecurity-Skills

This capability provides advanced threat hunting by analyzing network telemetry (DNS, proxy, connection logs) to detect Command and Control (C2) beaconing patterns. It uses statistical analysis, frequency detection, and jitter analysis to identify compromised endpoints communicating with adversary infrastructure, crucial for proactive threat detection and incident response.

Hunting Lateral Movement Using WMI Events

hunting-for-lateral-movement-via-wmi

mukul975/Anthropic-Cybersecurity-Skills

This skill detects WMI-based lateral movement by analyzing key Windows Security Event ID 4688 and Sysmon Event ID 1 logs. It focuses on identifying suspicious process execution patterns, such as WmiPrvSE.exe spawning unauthorized child processes (cmd.exe, powershell.exe), suspicious command lines, and WMI event subscriptions used for persistence. Ideal for security incident response and threat detection.

Hunting For Spearphishing Indicators Detection

hunting-for-spearphishing-indicators

mukul975/Anthropic-Cybersecurity-Skills

This guide details a structured threat hunting methodology designed to proactively detect sophisticated spearphishing campaigns. It instructs users on correlating indicators across email logs, endpoint telemetry (EDR), and network data (SIEM) to identify targeted threats, supporting incident response and security posture improvement.

Language