Download

Skill UI

Browse and discover 6170+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search MITRE , found 42 results

Default Newest Most Downloaded

Cloud Penetration Testing Guide

conducting-cloud-penetration-testing

mukul975/Anthropic-Cybersecurity-Skills

Provides a methodology for authorized penetration testing across AWS, Azure, and GCP clouds, detailing scope definition, reconnaissance with ScoutSuite/Prowler, IAM privilege escalation via Pacu, SSRF metadata access, and MITRE ATT&CK Cloud-aligned reporting.

Comprehensive Red Team Engagement

conducting-full-scope-red-team-engagement

mukul975/Anthropic-Cybersecurity-Skills

Guides planning and execution of a full-scope red team engagement from reconnaissance through post-exploitation, using MITRE ATT&CK-aligned TTPs to measure an organization’s detection and response readiness with scripted phases and artifact collection.

Evasion Detection Toolkit

detecting-evasion-techniques-in-endpoint-logs

mukul975/Anthropic-Cybersecurity-Skills

Guides security analysts through endpoint log use cases for detecting defense evasion tactics such as log tampering, timestomping, process injection, masquerading, LOLBin abuse, and security tool disabling to support hunting, rule development, and investigation aligned with MITRE ATT&CK TA0005.

Golden Ticket Forgery Detection

detecting-golden-ticket-forgery

mukul975/Anthropic-Cybersecurity-Skills

Detects Golden Ticket forgery by analyzing Windows Event IDs 4768/4769 for RC4 downgrades, orphaned TGS requests, excessive ticket lifetimes, and krbtgt anomalies in Splunk or Elastic SIEM, producing MITRE-mapped risk reports.

Lateral Movement Detection

detecting-lateral-movement-in-network

mukul975/Anthropic-Cybersecurity-Skills

Analyzes authentication logs, SMB flows, RDP sessions, and Zeek data to spot MITRE ATT&CK lateral movement techniques, powering SIEM alerts, hunting, and post-compromise investigations in enterprise networks.

Suspicious PowerShell Detection

detecting-suspicious-powershell-execution

mukul975/Anthropic-Cybersecurity-Skills

Hunts suspicious PowerShell executions by spotting encoded commands, macro-triggered download cradles, AMSI bypass attempts, and constrained language evasion across EDR and SIEM telemetry, tying results back to MITRE T1059 in proactive detection or incident-response workflows.

Sysmon Injection Detection

detecting-t1055-process-injection-with-sysmon

mukul975/Anthropic-Cybersecurity-Skills

Detects MITRE T1055 process injection techniques by correlating Sysmon events for remote thread creation, suspicious process access, anomalous DLL loading, and process hollowing to validate detections and feed SIEM alerts in threat-hunting workflows.

Advanced Threat Hunting

hunting-advanced-persistent-threats

mukul975/Anthropic-Cybersecurity-Skills

Hunt for Advanced Persistent Threats across endpoints, network logs, and memory using MITRE ATT&CK hypotheses, Velociraptor/osquery queries, and SIEM pivots to validate threats or gaps before escalation.

Data Staging Hunt

hunting-for-data-staging-before-exfiltration

mukul975/Anthropic-Cybersecurity-Skills

Detects data-staging activity prior to exfiltration by tracking archive tool execution, staging directories, large file consolidations, and sensitive path access via EDR/Sysmon telemetry; outputs risk scores, archive timelines, and MITRE ATT&CK mappings for hunters.

Timestomping Defense Evasion Hunting

hunting-for-defense-evasion-via-timestomping

mukul975/Anthropic-Cybersecurity-Skills

Analyzes NTFS MFT entries with MFTECmd and Python to detect MITRE T1070.006 timestomping by comparing $STANDARD_INFORMATION and $FILE_NAME timestamps, flagging anomalous gaps for SOC analysts and forensic triage.

Domain Fronting Detection

hunting-for-domain-fronting-c2-traffic

mukul975/Anthropic-Cybersecurity-Skills

Detect domain fronting C2 traffic by correlating proxy SNI vs HTTP Host mismatches, TLS certificate issuers, and CDN IP ranges, then scoring alerts for MITRE ATT&CK T1090.004 investigations.

NTLM Relay Detection Guide

hunting-for-ntlm-relay-attacks

mukul975/Anthropic-Cybersecurity-Skills

Detect NTLM relay attacks by analyzing Windows Security Event 4624 logon type 3 entries with NTLMSSP, correlating WorkstationName/IP inconsistencies, SMB signing state, and named pipe activity to surface suspicious authentication flows with MITRE T1557.001 mapping.

Prev 123 4 Next

Language