Download

Skill UI

Browse and discover 16569+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search Persistence , found 85 results

Default Newest Most Downloaded

Hunting WMI Persistence via Event Subscriptions

hunting-for-persistence-via-wmi-subscriptions

mukul975/Anthropic-Cybersecurity-Skills

This method targets fileless and trigger-based persistence mechanisms on Windows hosts by monitoring WMI event subscriptions (MITRE T1546.003). It hunts for suspicious activity involving WMI Event Filters, Consumers, and Bindings, which are critical indicators during advanced threat hunting and incident response when standard persistence locations are clean.

Hunting Registry Persistence Mechanisms

hunting-for-registry-persistence-mechanisms

mukul975/Anthropic-Cybersecurity-Skills

This skill guides proactive security auditing and threat hunting for registry-based persistence artifacts (MITRE T1547) in Windows environments. It focuses on identifying mechanisms such as Run/RunOnce keys, Winlogon modifications, IFEO debugger injection, and COM hijacking to detect malware autostart techniques and scope compromises during incident response.

Detecting Registry Run Key Persistence

hunting-for-registry-run-key-persistence

mukul975/Anthropic-Cybersecurity-Skills

This guide details a threat hunting technique for detecting persistence mechanisms utilizing Windows Registry Run keys (T1547.001). By analyzing Sysmon Event ID 13 logs, it identifies suspicious auto-start entries pointing to temporary directories, encoded PowerShell commands, or abused LOLBins. Essential for SOC analysts and security engineers investigating incidents and developing robust detection rules.

Hunting Scheduled Task Persistence Techniques

hunting-for-scheduled-task-persistence

mukul975/Anthropic-Cybersecurity-Skills

A comprehensive guide for hypothesis-driven threat hunting focusing on Windows Scheduled Task persistence (T1053). This methodology guides the creation of advanced SIEM/EDR queries against critical events like task creation (Event ID 4698), suspicious actions, and unusual scheduling patterns. Essential for incident response, proactive threat hunting, and security assessments.

Detecting Startup Folder Persistence Attacks

hunting-for-startup-folder-persistence

mukul975/Anthropic-Cybersecurity-Skills

This skill detects persistence mechanisms by monitoring Windows startup directories for suspicious file creation (T1547.001). It utilizes real-time file system monitoring via Python watchdog, cross-references Autoruns entries, and analyzes file metadata to identify implants that survive system reboots. Essential for threat hunting and validating security monitoring coverage.

Hunting Suspicious Windows Scheduled Tasks

hunting-for-suspicious-scheduled-tasks

mukul975/Anthropic-Cybersecurity-Skills

A comprehensive threat hunting guide designed to detect adversary persistence and execution mechanisms hidden within Windows scheduled tasks (T1053.005). This skill analyzes Security Event ID 4698, suspicious task properties, and unusual execution patterns from tools like schtasks.exe. It is vital for incident response, proactive threat hunting, and enumerating persistence on compromised endpoints.

Detect Suspicious Windows Service Installations

hunting-for-unusual-service-installations

mukul975/Anthropic-Cybersecurity-Skills

This skill performs threat hunting for persistence mechanisms by parsing Windows System event logs (Event ID 7045). It specifically detects suspicious service installations, analyzing service binary paths, and correlating these events with advanced telemetry (Sysmon/EDR) to identify indicators of compromise (MITRE ATT&CK T1543.003). Ideal for incident response and security validation.

Osquery Endpoint Monitoring Setup

implementing-osquery-for-endpoint-monitoring

mukul975/Anthropic-Cybersecurity-Skills

Automate the deployment of osquery scheduled queries to continuously monitor endpoints, covering process inventory, network listeners, file integrity, and persistence mechanisms; generate osquery.conf, configure differential logging, analyze suspicious results, and produce a security report.

Digital Forensics Malware Persistence Analysis

performing-malware-persistence-investigation

mukul975/Anthropic-Cybersecurity-Skills

This script systematically investigates all persistence mechanisms on Windows and Linux systems. It analyzes critical areas like the Windows Registry (SYSTEM, SOFTWARE, HKCU), scheduled tasks, and common run keys to identify how malware maintains access and survives system reboots. It is essential for advanced incident response, threat hunting, and digital forensics investigations.

Windows Artifact Analysis Using EZ Tools

performing-windows-artifact-analysis-with-eric-zimmerman-tools

mukul975/Anthropic-Cybersecurity-Skills

This suite provides comprehensive utilities for digital forensic investigations, allowing users to analyze critical Windows artifacts. Tools like KAPE, MFTECmd, PECmd, and RECmd parse registry hives, $MFT records, prefetch files, and event logs. It is essential for building a robust timeline of program execution, file access patterns, and system persistence during DFIR incident response.

Analyzing UEFI Bootkits and Firmware Integrity

analyzing-uefi-bootkit-persistence

mukul975/Anthropic-Cybersecurity-Skills

A deep dive toolset for forensic investigation of advanced persistent threats (APT) at the firmware level. It analyzes UEFI variable modifications, SPI flash implants, Secure Boot bypass techniques, and unauthorized components within the EFI System Partition (ESP). Utilizes tools like chipsec, flashrom, and YARA for comprehensive integrity verification.

Firebase Cloud Firestore Guide

firebase-cloud-firestore

evanca/flutter-ai-rules

Guidance for implementing Cloud Firestore in Flutter: selecting the database, configuring offline persistence, designing schemas, querying with filters and pagination, writing batched transactions, indexing, optimizing for scale, and avoiding write hotspots.

Prev 1 2 345 6 7 8 Next

Language