Download

Skill UI

Browse and discover 5987+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search Detection , found 247 results

Default Newest Most Downloaded

Insider Threat Detection

detecting-insider-threat-behaviors

mukul975/Anthropic-Cybersecurity-Skills

Detects insider threat behaviors by hunting for unusual data access, privilege abuse, mass downloads, and resignation-linked exfiltration across EDR, SIEM, and intelligence sources to guide incident response actions.

Detect Insider Threats

detecting-insider-threat-with-ueba

mukul975/Anthropic-Cybersecurity-Skills

Implements UEBA using Elasticsearch/OpenSearch to normalize authentication, file, and network logs, establish behavioral baselines, calculate anomaly scores through deviation and peer-group analysis, and correlate indicators into SOC-ready alerts for insider threat detection.

Kerberoasting Detection Guide

detecting-kerberoasting-attacks

mukul975/Anthropic-Cybersecurity-Skills

Documented workflow for hunting Kerberoasting activity by correlating SIEM and EDR telemetry, validating findings, and reporting observations so defenders can proactively detect Credential Access abuse.

Lateral Movement Detection

detecting-lateral-movement-in-network

mukul975/Anthropic-Cybersecurity-Skills

Analyzes authentication logs, SMB flows, RDP sessions, and Zeek data to spot MITRE ATT&CK lateral movement techniques, powering SIEM alerts, hunting, and post-compromise investigations in enterprise networks.

Living Off The Land Detection

detecting-living-off-the-land-attacks

mukul975/Anthropic-Cybersecurity-Skills

Detects abuse of legitimate Windows binaries by tracking process creation, command-line parameters, and parent-child relationships to flag living-off-the-land and fileless attack patterns.

LOLBA Detection Playbook

detecting-living-off-the-land-with-lolbas

mukul975/Anthropic-Cybersecurity-Skills

Detect abuse of Living Off the Land binaries such as certutil, regsvr32, mshta, and rundll32 by ingesting Sysmon and Windows event telemetry, generating Sigma rules, and analyzing parent-child process chains to score alerts and report MITRE ATT&CK mappings.

Sysmon Scheduled Task Detection

detecting-malicious-scheduled-tasks-with-sysmon

mukul975/Anthropic-Cybersecurity-Skills

Detects malicious scheduled task creation and modification by correlating Sysmon IDs 1 and 11 with Windows Event 4698/4702, highlighting persistence hunting, suspicious parent processes, public paths, and encoded commands when tracking T1053.005 activity.

Mimikatz Execution Detection

detecting-mimikatz-execution-patterns

mukul975/Anthropic-Cybersecurity-Skills

Detect execution patterns of Mimikatz by correlating command-line signatures, LSASS access anomalies, binary indicators, and in-memory modules across EDR and SIEM telemetry, supporting proactive threat hunting and incident response.

Modbus Injection Detection

detecting-modbus-command-injection-attacks

mukul975/Anthropic-Cybersecurity-Skills

Detects Modbus command injection attacks in ICS by monitoring Modbus TCP/RTU traffic for unauthorized writes, anomalous function codes, and baseline deviations using IDS/protocol inspection so SOC analysts can flag FrostyGoop-style manipulations before they impact PLC operations.

Modbus Anomaly Detection

detecting-modbus-protocol-anomalies

mukul975/Anthropic-Cybersecurity-Skills

Detects Modbus/TCP and RTU anomalies by monitoring function codes, register ranges, timing, unauthorized clients, and malformed frames using Zeek, Suricata OT rules, and Python-based Markov models for deterministic industrial polling.

Zeek Network Anomaly Detection

detecting-network-anomalies-with-zeek

mukul975/Anthropic-Cybersecurity-Skills

Deploys Zeek to passively monitor network traffic, emit structured connection/DNS/HTTP/SSL logs, and run custom scripts that flag anomalous behavior for threat hunting and incident response teams.

IDS Network Scan Detection

detecting-network-scanning-with-ids-signatures

mukul975/Anthropic-Cybersecurity-Skills

Detect reconnaissance tools such as Nmap and Masscan using Suricata/Snort IDS signatures, thresholds, and anomaly cues to alert on TCP/UDP scans, SYN/ACK probes, and other scan fingerprints before threat actors escalate.

Prev 1 2 3...11 12 131415 16 17...19 20 21 Next

Language