Download

Skill UI

Browse and discover 6283+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search Forensics , found 32 results

Default Newest Most Downloaded

Process Injection Detection

detecting-process-injection-techniques

mukul975/Anthropic-Cybersecurity-Skills

Analyzes malware process injection techniques across DLL injection, hollowing, APC, thread hijacking, and reflective loading using memory forensics, API monitoring, and Sysmon data to help EDR/SIEM detection.

Rootkit Activity Detection

detecting-rootkit-activity

mukul975/Anthropic-Cybersecurity-Skills

Detects hidden rootkit behavior on compromised machines by combining memory forensics, cross-view process enumeration, kernel integrity checks, and file/registry hiding detection to reveal hooked system calls and covert connections.

Browser History Forensics

extracting-browser-history-artifacts

mukul975/Anthropic-Cybersecurity-Skills

Extracts and analyzes Chrome, Firefox, and Edge browsing history, cookies, downloads, bookmarks, and other artifacts to build forensic timelines, track exfiltration, and reveal malicious or policy-violating web activity during investigations.

Rekall Memory Artifacts

extracting-memory-artifacts-with-rekall

mukul975/Anthropic-Cybersecurity-Skills

Leverages Rekall memory-forensics plugins to inspect Windows memory dumps for injected code, hidden processes, and suspicious DLLs, aiding incident response and threat discovery during security tests or red-team engagements.

Phishing Email Incident Analysis

investigating-phishing-email-incident

mukul975/Anthropic-Cybersecurity-Skills

Investigates phishing email reports end-to-end—header forensics, URL/attachment detonation, campaign scope analysis, impacted user tracing, and containment using SOC tools.

Cloud Forensics Investigation

performing-cloud-forensics-investigation

mukul975/Anthropic-Cybersecurity-Skills

Guides investigators through AWS/Azure/GCP forensic workflows, covering evidence preservation, log collection, IAM analysis, and incident response to trace breaches in cloud environments.

AWS CloudTrail Forensics

performing-cloud-forensics-with-aws-cloudtrail

mukul975/Anthropic-Cybersecurity-Skills

Guide for using CloudTrail logs, boto3, Athena, and CLI tools to reconstruct AWS attacker activity, surface compromised credentials, and document API-based incident investigations when responding to cloud breaches.

Falco Cloud Forensics

performing-cloud-native-forensics-with-falco

mukul975/Anthropic-Cybersecurity-Skills

Uses Falco rule deployment and alert parsing to detect shell spawns, file tampering, anomalous outbound connections, and privilege escalations in containers and Kubernetes clusters for runtime security assessments and incident response.

Disk Forensics Investigation

performing-disk-forensics-investigation

mukul975/Anthropic-Cybersecurity-Skills

Conducts systematic disk forensics by imaging evidence, analyzing file systems, recovering deleted files and artifacts, and reconstructing timelines to support incident response and legal investigations involving hard drives and SSDs.

Endpoint Forensics Investigation

performing-endpoint-forensics-investigation

mukul975/Anthropic-Cybersecurity-Skills

Performs endpoint-focused digital forensics including memory acquisition, disk imaging, artifact analysis, and timeline reconstruction so teams can investigate compromises, gather court-ready evidence, and understand incident scope.

Linux Log Forensics

performing-linux-log-forensics-investigation

mukul975/Anthropic-Cybersecurity-Skills

Provides a structured walkthrough for analyzing Linux auth/sys/kernel logs, systemd journal exports, cron data, and auditd records to reconstruct user activity, identify intrusions, and document incident timelines during security assessments.

Memory Forensics With Volatility

performing-memory-forensics-with-volatility3

mukul975/Anthropic-Cybersecurity-Skills

Use Volatility 3 to inspect volatile memory dumps, enumerate processes, network connections, loaded modules, and hidden artifacts, enabling incident responders to spot malware, credential theft, and injected code without relying on disk data.

Language