Download

Skill UI

Browse and discover 6170+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search Monitor , found 493 results

Default Newest Most Downloaded

Modbus Injection Detection

detecting-modbus-command-injection-attacks

mukul975/Anthropic-Cybersecurity-Skills

Detects Modbus command injection attacks in ICS by monitoring Modbus TCP/RTU traffic for unauthorized writes, anomalous function codes, and baseline deviations using IDS/protocol inspection so SOC analysts can flag FrostyGoop-style manipulations before they impact PLC operations.

Modbus Anomaly Detection

detecting-modbus-protocol-anomalies

mukul975/Anthropic-Cybersecurity-Skills

Detects Modbus/TCP and RTU anomalies by monitoring function codes, register ranges, timing, unauthorized clients, and malformed frames using Zeek, Suricata OT rules, and Python-based Markov models for deterministic industrial polling.

Zeek Network Anomaly Detection

detecting-network-anomalies-with-zeek

mukul975/Anthropic-Cybersecurity-Skills

Deploys Zeek to passively monitor network traffic, emit structured connection/DNS/HTTP/SSL logs, and run custom scripts that flag anomalous behavior for threat hunting and incident response teams.

Process Injection Detection

detecting-process-injection-techniques

mukul975/Anthropic-Cybersecurity-Skills

Detects malicious process injection techniques through memory forensics, Sysmon/API monitoring, and behavioral signals, aiding EDR/SIEM teams in spotting DLL injection, hollowing, APC/thread hijacking, reflective loading, and similar stealthy attacks.

Shadow API Detection

detecting-shadow-api-endpoints

mukul975/Anthropic-Cybersecurity-Skills

Analyzes traffic, logs, code, and API specs to surface undocumented endpoints so SOC and API teams can detect shadow APIs, validate monitoring coverage, and enforce governance.

Detecting Stuxnet Attacks

detecting-stuxnet-style-attacks

mukul975/Anthropic-Cybersecurity-Skills

Detect Stuxnet-style multi-stage OT attacks by monitoring PLC logic integrity, engineering workstations, USB vectors, IT-to-OT lateral movement, and physics-based process anomalies to thwart nation-state level threats.

Suspicious OAuth Consent Detection

detecting-suspicious-oauth-application-consent

mukul975/Anthropic-Cybersecurity-Skills

Uses Microsoft Graph, audit logs, and permission analysis to uncover illicit consent grants for OAuth apps in Azure AD / Entra ID, helping SOC analysts hunt threats and validate monitoring coverage for risky permissions.

Elevation Control Abuse Detection

detecting-t1548-abuse-elevation-control-mechanism

mukul975/Anthropic-Cybersecurity-Skills

Detect T1548 elevation control abuse by monitoring UAC bypass registry tweaks, auto-elevating binaries, process integrity jumps, and Linux setuid/sudo misuse, enabling threat hunters to spot credential-free privilege escalation chains across Windows and Linux.

BGP Hijack Simulation Lab

exploiting-bgp-hijacking-vulnerabilities

mukul975/Anthropic-Cybersecurity-Skills

Simulates BGP hijacking scenarios in isolated labs to assess route origin validation, RPKI deployment, and monitoring defenses so network teams can verify prefix filtering, AS path handling, and alerting without touching production routing.

WMI Subscription Persistence

hunting-for-persistence-via-wmi-subscriptions

mukul975/Anthropic-Cybersecurity-Skills

Guide to hunting WMI-based persistence by monitoring Sysmon and Windows WMI subscription creation events, enumerating dangerous filters and consumers, analyzing triggers, and correlating WmiPrvSe.exe activity and MOF compilation to detect stealthy threats.

Startup Folder Persistence Detection

hunting-for-startup-folder-persistence

mukul975/Anthropic-Cybersecurity-Skills

Detect Windows startup folder persistence by scanning user and system autostart directories, flagging suspicious file types, monitoring real-time changes via Python watchdog, and generating T1547.001-aligned threat hunting reports for incident responders.

LOLBAS Detection Rules

hunting-living-off-the-land-binaries

mukul975/Anthropic-Cybersecurity-Skills

Monitors Windows process creation events to flag Living Off The Land Binary abuse by matching Event ID 4688/Sysmon 1 logs against LOLBAS database entries, supporting threat hunting and SIEM rule creation for fileless attacks.

Prev 1 2 3...33 34 353637 38 39 40 41 42 Next

Language