Download

Skill UI

Browse and discover 6152+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search Persistence , found 42 results

Default Newest Most Downloaded

Windows Event Log Forensics

extracting-windows-event-logs-artifacts

mukul975/Anthropic-Cybersecurity-Skills

Extract, parse, and analyze EVTX files with Chainsaw, Hayabusa, and EvtxECmd to uncover lateral movement, persistence, and privilege escalation during incident response and forensic investigations.

DNS Persistence Hunting

hunting-for-dns-based-persistence

mukul975/Anthropic-Cybersecurity-Skills

Hunt DNS-based persistence by auditing passive DNS data, SecurityTrails history, audit logs, and zone transfers to uncover hijacked records, dangling CNAMEs, wildcard abuse, and unauthorized delegations across cloud/on-prem domains.

Detect WMI Lateral Movement

hunting-for-lateral-movement-via-wmi

mukul975/Anthropic-Cybersecurity-Skills

Detect WMI-based lateral movement by analyzing Windows Event ID 4688 and Sysmon Event ID 1 logs for WmiPrvSE.exe child processes, suspicious command lines, and WMI event subscriptions that signal persistence or remote execution during incident response.

Windows Persistence Hunting

hunting-for-persistence-mechanisms-in-windows

mukul975/Anthropic-Cybersecurity-Skills

Guided workflow for hunting Windows persistence by enumerating registry, services, tasks, WMI, and startup entries, correlating artifacts with endpoint telemetry, and documenting findings for proactive defense.

WMI Subscription Persistence

hunting-for-persistence-via-wmi-subscriptions

mukul975/Anthropic-Cybersecurity-Skills

Guide to hunting WMI-based persistence by monitoring Sysmon and Windows WMI subscription creation events, enumerating dangerous filters and consumers, analyzing triggers, and correlating WmiPrvSe.exe activity and MOF compilation to detect stealthy threats.

Registry Persistence Hunt

hunting-for-registry-persistence-mechanisms

mukul975/Anthropic-Cybersecurity-Skills

Step-by-step guide for hunting registry-based persistence mechanisms with SIEM/EDR telemetry, covering Run keys, Winlogon, IFEO, and COM hijacking to validate threat intelligence and report findings.

Registry Run Key Hunting

hunting-for-registry-run-key-persistence

mukul975/Anthropic-Cybersecurity-Skills

Guides threat hunters through analyzing Sysmon Event ID 13 and related events to detect MITRE ATT&CK T1547.001 registry Run key persistence, highlighting suspicious paths, LOLBin usage, encoded scripts, and how to escalate findings into Sigma/Splunk rules.

Scheduled Task Persistence Hunt

hunting-for-scheduled-task-persistence

mukul975/Anthropic-Cybersecurity-Skills

Hunt for adversary persistence via Windows Scheduled Tasks by analyzing creation events, suspicious task actions, and unusual scheduling patterns across EDR and SIEM telemetry to validate detections and inform incident response.

Startup Folder Persistence Detection

hunting-for-startup-folder-persistence

mukul975/Anthropic-Cybersecurity-Skills

Detect Windows startup folder persistence by scanning user and system autostart directories, flagging suspicious file types, monitoring real-time changes via Python watchdog, and generating T1547.001-aligned threat hunting reports for incident responders.

Suspicious Scheduled Task Hunt

hunting-for-suspicious-scheduled-tasks

mukul975/Anthropic-Cybersecurity-Skills

Hunt for persistence via Windows scheduled tasks by analyzing creation events, suspicious properties, and execution anomalies to catch T1053.005 abuse during threat hunting or incident response.

Hunt Unusual Service Installs

hunting-for-unusual-service-installations

mukul975/Anthropic-Cybersecurity-Skills

Detect suspicious Windows service installations by parsing System event logs for Event ID 7045, analyzing service binaries and paths, and highlighting persistence indicators tied to MITRE ATT&CK T1543.003 for focused SOC response.

Osquery Endpoint Monitoring Setup

implementing-osquery-for-endpoint-monitoring

mukul975/Anthropic-Cybersecurity-Skills

Automate the deployment of osquery scheduled queries to continuously monitor endpoints, covering process inventory, network listeners, file integrity, and persistence mechanisms; generate osquery.conf, configure differential logging, analyze suspicious results, and produce a security report.

Prev 1 234 Next

Language