Download

Skill UI

Browse and discover 6004+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search Proactive Detection , found 13 results

Default Newest Most Downloaded

Threat Hunt Hypothesis

building-threat-hunt-hypothesis-framework

mukul975/Anthropic-Cybersecurity-Skills

Establishes a systematic process that turns threat intelligence, ATT&CK gaps, and telemetry into testable hunting hypotheses, guiding analysts through data selection, query execution, and reporting for proactive detection and response.

Kerberoasting Detection Guide

detecting-kerberoasting-attacks

mukul975/Anthropic-Cybersecurity-Skills

Documented workflow for hunting Kerberoasting activity by correlating SIEM and EDR telemetry, validating findings, and reporting observations so defenders can proactively detect Credential Access abuse.

Mimikatz Execution Detection

detecting-mimikatz-execution-patterns

mukul975/Anthropic-Cybersecurity-Skills

Detect execution patterns of Mimikatz by correlating command-line signatures, LSASS access anomalies, binary indicators, and in-memory modules across EDR and SIEM telemetry, supporting proactive threat hunting and incident response.

Pass The Hash Detection

detecting-pass-the-hash-attacks

mukul975/Anthropic-Cybersecurity-Skills

Detecting Pass-the-Hash attacks by correlating NTLM Type 3 logons, telemetry from EDR/SIEM, and credential-dumping IOCs to proactively hunt and validate incidents across Windows estates.

Detecting Pass-The-Ticket

detecting-pass-the-ticket-attacks

mukul975/Anthropic-Cybersecurity-Skills

Analyze Windows Event IDs 4768, 4769, and 4771 within Splunk or Elastic SIEM to identify anomalous Kerberos ticket usage, RC4 downgrades, and unusual service requests, enabling proactive Pass-the-Ticket threat detection.

Process Hollowing Detection

detecting-process-hollowing-technique

mukul975/Anthropic-Cybersecurity-Skills

Detect process hollowing (T1055.012) by analyzing EDR telemetry for suspended process creation, memory section anomalies, integrity mismatches, and correlated network evidence to hunt for in-memory threats and proactive defense.

Service Account Abuse Detection

detecting-service-account-abuse

mukul975/Anthropic-Cybersecurity-Skills

Provides a detection workflow for service account abuse by leveraging EDR and SIEM telemetry to hunt for anomalous logons, lateral movement, privilege escalation, and unauthorized access, aiding proactive hunting, incident response, and purple team exercises.

Suspicious PowerShell Detection

detecting-suspicious-powershell-execution

mukul975/Anthropic-Cybersecurity-Skills

Hunts suspicious PowerShell executions by spotting encoded commands, macro-triggered download cradles, AMSI bypass attempts, and constrained language evasion across EDR and SIEM telemetry, tying results back to MITRE T1059 in proactive detection or incident-response workflows.

Living Off-the-Land Hunt

hunting-for-living-off-the-land-binaries

mukul975/Anthropic-Cybersecurity-Skills

Proactively hunt for adversary abuse of legitimate system binaries (LOLBins) by analyzing EDR/SIEM telemetry, correlating network activity, and documenting findings to inform detections for defense-evasion scenarios.

Spearphishing Threat Hunt

hunting-for-spearphishing-indicators

mukul975/Anthropic-Cybersecurity-Skills

Guide on hunting spearphishing indicators across email logs, endpoint telemetry, and network data with workflows, tools, scenarios, and output formats for proactive campaign detection and response.

Supply Chain Compromise Hunt

hunting-for-supply-chain-compromise

mukul975/Anthropic-Cybersecurity-Skills

Guides proactive hunting for supply chain compromise indicators across EDR and SIEM telemetry, validating results, correlating ATT&CK TTPs, and documenting findings to inform containment and detection tuning.

Webshell Hunting Workflow

hunting-for-webshell-activity

mukul975/Anthropic-Cybersecurity-Skills

Hunt for web shell deployments on internet-facing servers by analyzing file writes, spawned processes, and HTTP anomalies; use this guide during proactive threat-hunting, incident response, and SIEM/EDR detection tuning.

Language