Download

Skill UI

Browse and discover 19258+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search detection , found 491 results

Default Newest Most Downloaded

Detecting Evasion Techniques in Endpoint Logs

detecting-evasion-techniques-in-endpoint-logs

mukul975/Anthropic-Cybersecurity-Skills

This skill provides comprehensive detection rules for advanced defense evasion techniques used by adversaries, including log tampering (T1070), timestomping, process injection (T1055), and disabling security tools (T1562). It is ideal for threat hunting, building detection rules, and investigating stealthy attacker activity using Sysmon and SIEM data.

Detecting DNS Exfiltration Using Zeek Analysis

detecting-exfiltration-over-dns-with-zeek

mukul975/Anthropic-Cybersecurity-Skills

This skill detects DNS-based data exfiltration by analyzing Zeek dns.log files. It identifies indicators such as high Shannon entropy subdomains, oversized TXT/NULL records, and abnormal query volumes. Use it when investigating suspected DNS tunneling or covert C2 channels to enhance threat detection capabilities.

Detecting Fileless Attacks On Endpoints

detecting-fileless-attacks-on-endpoints

mukul975/Anthropic-Cybersecurity-Skills

This skill provides comprehensive guidance and detection rules for identifying fileless malware, in-memory attacks, and living-off-the-land techniques. It covers detecting PowerShell exploitation, reflective DLL injection, WMI abuse, and registry-resident threats, enabling security teams to build robust detections when traditional antivirus fails.

Fileless Malware Detection

detecting-fileless-malware-techniques

mukul975/Anthropic-Cybersecurity-Skills

Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and LOLBins. Use for fileless threat detection, in-memory malware investigation, LOLBin abuse analysis, or WMI persistence examination.

Detecting Insider Data Exfiltration Patterns

detecting-insider-data-exfiltration-via-dlp

mukul975/Anthropic-Cybersecurity-Skills

This skill provides structured procedures and Python examples for detecting internal data exfiltration. It analyzes endpoint, cloud, and email logs by establishing behavioral baselines and performing statistical anomaly detection. Use cases include investigating insider threats, monitoring DLP policy violations, and building robust User and Entity Behavior Analytics (UEBA) rules for SOC teams.

Detecting Lateral Movement in Enterprise Networks

detecting-lateral-movement-in-network

mukul975/Anthropic-Cybersecurity-Skills

A comprehensive guide and framework for detecting attacker lateral movement within enterprise networks. It details the use of network flow analysis (Zeek), authentication log review (Windows Event Logs, Kerberos), and dedicated SIEM correlation rules (Splunk, Elastic) to identify techniques like Pass-the-Hash and RDP hopping. Ideal for threat hunters and security engineers building detection pipelines.

Detecting Living Off The Land Attacks

detecting-living-off-the-land-attacks

mukul975/Anthropic-Cybersecurity-Skills

This skill focuses on advanced threat detection techniques used to identify the abuse of legitimate Windows binaries (LOLBins) for malicious purposes. It requires monitoring process creation, command-line arguments, and network activity to pinpoint fileless and living-off-the-land attacks. Ideal for building SIEM/EDR detection rules, threat hunting, and hardening endpoint security policies.

Detecting LOLBAS Abuse with System Monitoring

detecting-living-off-the-land-with-lolbas

mukul975/Anthropic-Cybersecurity-Skills

This skill provides a comprehensive methodology for detecting Living Off the Land Binaries (LOLBAS) abuse. It analyzes process telemetry (Sysmon, Windows Logs) and parent-child relationships to identify when attackers misuse legitimate Windows utilities (like certutil, mshta, rundll32) to execute malicious code while bypassing traditional security detection. Essential for threat hunting and advanced incident response.

Detecting Malicious Scheduled Tasks with Sysmon

detecting-malicious-scheduled-tasks-with-sysmon

mukul975/Anthropic-Cybersecurity-Skills

This skill provides a structured methodology for detecting persistence and lateral movement via malicious scheduled tasks. It utilizes Sysmon Event IDs (1, 11) and Windows Security Events (4698/4702) to correlate process creation, task file writes, and task registration details. Ideal for threat hunting and building robust detection rules for T1053.005.

Detecting Mimikatz Credential Dumping Patterns

detecting-mimikatz-execution-patterns

mukul975/Anthropic-Cybersecurity-Skills

A comprehensive guide and workflow for detecting Mimikatz and similar credential-dumping activities. It utilizes command-line pattern matching, LSASS memory access signatures, binary indicators, and in-memory analysis. Ideal for threat hunting, scoping compromises during incident response, or validating detection coverage in purple team exercises using EDR/SIEM data.

Detect Modbus Command Injection Attacks

detecting-modbus-command-injection-attacks

mukul975/Anthropic-Cybersecurity-Skills

An advanced Intrusion Detection System (IDS) module designed for Operational Technology (OT) and ICS/SCADA environments. It monitors Modbus TCP/RTU traffic to detect unauthorized writes, anomalous function codes, malformed frames, and deviations from established communication baselines. Essential for investigating suspicious PLC register modifications and responding to industrial threats.

Zeek for Network Anomaly Detection

detecting-network-anomalies-with-zeek

mukul975/Anthropic-Cybersecurity-Skills

Deploy Zeek for passive network analysis to generate structured logs (DNS, HTTP, etc.). This tool detects behavioral anomalies like DNS tunneling or beaconing, complementing traditional signature-based IDS tools. It is ideal for threat hunting and incident response, feeding rich protocol metadata into SIEM platforms.

Prev 1 2 3...10 11 121314 15 16...39 40 41 Next

Language