Download

Skill UI

Browse and discover 9651+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search Incident Response , found 168 results

Default Newest Most Downloaded

Detect Living Off Land Attacks

detecting-living-off-the-land-attacks

mukul975/Anthropic-Cybersecurity-Skills

Monitors Windows process creation, parent-child relationships, command lines, and network activity to flag suspicious LOLBin use for SIEM/EDR detection, Sigma rule tuning, and incident response workflows.

Mobile Malware Behavior Detection

detecting-mobile-malware-behavior

mukul975/Anthropic-Cybersecurity-Skills

Detects and analyzes malicious behavior in Android and iOS apps through static, MobSF, Frida, and network monitoring workflows, helping analysts triage suspicious builds, hunt indicators, and validate exfiltration or C2 signals during incident response.

Zeek Network Anomaly Detection

detecting-network-anomalies-with-zeek

mukul975/Anthropic-Cybersecurity-Skills

Deploy Zeek to passively observe traffic, emit structured logs, and apply bespoke detection scripts for threat hunting, incident response, and monitoring anomalous network behavior.

Pass Hash Attack Detection

detecting-pass-the-hash-attacks

mukul975/Anthropic-Cybersecurity-Skills

Detects Pass-the-Hash attacks by analyzing NTLM logon patterns and correlating credential dumping telemetry via SIEM/EDR hunting, aiding proactive threat hunting, incident response, and purple-team exercises.

Fail2ban Port Scan Guard

detecting-port-scanning-with-fail2ban

mukul975/Anthropic-Cybersecurity-Skills

Configures Fail2ban with custom filters, iptables logging, and webhook ban actions to detect port scanning, SSH brute-force, and HTTP probes, automatically blocking offenders and notifying teams for faster incident response.

Detecting WMI Persistence for Threat Hunting

detecting-wmi-persistence

mukul975/Anthropic-Cybersecurity-Skills

This guide details methods for detecting WMI event subscription persistence, a common technique used by adversaries (MITRE ATT&CK T1546.003). It focuses on analyzing Sysmon Event IDs 19, 20, and 21 to identify malicious EventFilters, EventConsumers, and their bindings. Use this technique during incident response or threat hunting to uncover hidden persistence mechanisms within Windows environments.

Malware Eradication Workflow

eradicating-malware-from-infected-systems

mukul975/Anthropic-Cybersecurity-Skills

Step-by-step incident-response guidance for mapping persistence, identifying artifacts, removing malware, resetting credentials, patching entry points, and validating eradication to restore clean systems.

Memory Credential Extraction

extracting-credentials-from-memory-dump

mukul975/Anthropic-Cybersecurity-Skills

Use Volatility and Mimikatz/pypykatz to extract cached credentials, password hashes, Kerberos tickets, and authentication tokens from Windows memory dumps during forensic investigations or incident response to assess compromise scope.

Rekall Memory Artifact Extraction

extracting-memory-artifacts-with-rekall

mukul975/Anthropic-Cybersecurity-Skills

Analyze Windows memory dumps using Rekall to spot process hollowing, injected code, hidden PIDs, and suspicious DLLs during incident response.

Windows Event Log Forensics

extracting-windows-event-logs-artifacts

mukul975/Anthropic-Cybersecurity-Skills

Extract, parse, and analyze Windows EVTX files with Chainsaw, Hayabusa, and EvtxECmd to hunt lateral movement, privilege escalation, and persistence artifacts during incident response and compliance reviews.

Hunting Data Exfiltration Indicators

hunting-for-data-exfiltration-indicators

mukul975/Anthropic-Cybersecurity-Skills

Guides analysts through identifying and validating data exfiltration indicators via traffic baselines, anomaly detection, and protocol abuse analysis during incident response.

Suspicious Scheduled Task Hunt

hunting-for-suspicious-scheduled-tasks

mukul975/Anthropic-Cybersecurity-Skills

Detect and investigate suspicious Windows scheduled tasks by analyzing creation events, task properties, triggers, and execution correlations to expose persistence mechanisms, unusual activity, and MITRE T1053.005 abuse during proactive hunts or incident response.

Prev 1 2 3...5 6 789 10 11 12 13 14 Next

Language