Download

Skill UI

Browse and discover 6186+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search Lateral Movement , found 34 results

Default Newest Most Downloaded

Splunk Lateral Movement Hunt

detecting-lateral-movement-with-splunk

mukul975/Anthropic-Cybersecurity-Skills

Guide to hunting adversary lateral movement with Splunk SPL against Windows authentication, SMB flow, and remote service abuse logs, helping SOCs detect unusual logon graphs, anomalous service accounts, and scripted propagation.

Service Account Abuse Detection

detecting-service-account-abuse

mukul975/Anthropic-Cybersecurity-Skills

Provides a detection workflow for service account abuse by leveraging EDR and SIEM telemetry to hunt for anomalous logons, lateral movement, privilege escalation, and unauthorized access, aiding proactive hunting, incident response, and purple team exercises.

Detecting Stuxnet Attacks

detecting-stuxnet-style-attacks

mukul975/Anthropic-Cybersecurity-Skills

Detect Stuxnet-style multi-stage OT attacks by monitoring PLC logic integrity, engineering workstations, USB vectors, IT-to-OT lateral movement, and physics-based process anomalies to thwart nation-state level threats.

EDR Credential Dumping Detection

detecting-t1003-credential-dumping-with-edr

mukul975/Anthropic-Cybersecurity-Skills

Detects credential dumping T1003 activity by correlating EDR telemetry, Sysmon process access, and Windows security events to flag suspicious LSASS, SAM, NTDS, and cached credential access, guiding SOCs through containment and lateral movement analysis.

Constrained Delegation Abuse

exploiting-constrained-delegation-abuse

mukul975/Anthropic-Cybersecurity-Skills

Explains how to abuse Kerberos constrained delegation misconfigurations in Active Directory to impersonate privileged accounts via S4U2self/S4U2proxy, secure service tickets, and access CIFS/LDAP/HTTP targets for lateral movement and privilege escalation during red-team or authorized security exercises.

SMB Exploitation Playbook

exploiting-smb-vulnerabilities-with-metasploit

mukul975/Anthropic-Cybersecurity-Skills

Guides authorized testers through SMB-focused assessments with Metasploit and complementary tools, covering enumeration, vulnerability scanning, EternalBlue exploitation, relay attacks, pass-the-hash lateral movement, and post-exploitation clean-up.

Windows Event Log Forensics

extracting-windows-event-logs-artifacts

mukul975/Anthropic-Cybersecurity-Skills

Extract, parse, and analyze EVTX files with Chainsaw, Hayabusa, and EvtxECmd to uncover lateral movement, persistence, and privilege escalation during incident response and forensic investigations.

Detect WMI Lateral Movement

hunting-for-lateral-movement-via-wmi

mukul975/Anthropic-Cybersecurity-Skills

Detect WMI-based lateral movement by analyzing Windows Event ID 4688 and Sysmon Event ID 1 logs for WmiPrvSE.exe child processes, suspicious command lines, and WMI event subscriptions that signal persistence or remote execution during incident response.

Network Deception Honeypots

implementing-network-deception-with-honeypots

mukul975/Anthropic-Cybersecurity-Skills

Guides deploying and managing OpenCanary, Cowrie, and T-Pot honeypots to detect lateral movement, alert on unauthorized scanning, capture attacker commands, and feed SIEMs, with planning, configuration, monitoring, and maintenance steps.

Firewall Zone Network Segmentation

implementing-network-segmentation-with-firewall-zones

mukul975/Anthropic-Cybersecurity-Skills

Designs and implements layered network segmentation via firewall zones, VLANs, ACLs, and microsegmentation, giving security teams a blueprint for restricting lateral movement, meeting compliance, and hardening east-west traffic.

APT SIEM Correlation Rules

implementing-siem-correlation-rules-for-apt

mukul975/Anthropic-Cybersecurity-Skills

Creates Splunk/Sigma multi-event correlation rules that link Windows authentication, process execution, and network logs to expose APT lateral movement chains missed by single-event detections.

Cloud Incident Containment

performing-cloud-incident-containment-procedures

mukul975/Anthropic-Cybersecurity-Skills

Guides cloud-native incident containment across AWS, Azure, and GCP by isolating compromised resources, revoking credentials, capturing evidence, and tightening network controls to prevent lateral movement while supporting scripted and manual response workflows.

Language