Download

Skill UI

Browse and discover 5987+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search threat-detection , found 45 results

Default Newest Most Downloaded

Yara Rule Authoring

sickn33/antigravity-awesome-skills

Yara Authoring helps security teams write precise YARA rules for threat detection and malware hunting by guiding string/tag management and metadata handling so signature creation keeps pace with investigations.

Azure Activity Threat Hunting

analyzing-azure-activity-logs-for-threats

mukul975/Anthropic-Cybersecurity-Skills

Executes Azure Monitor activity and sign-in log queries using azure-monitor-query to spot suspicious admin operations, impossible travel, privilege escalation, and resource changes, supporting incident investigations and cloud SIEM detections.

Command-and-Control Analysis

analyzing-command-and-control-communication

mukul975/Anthropic-Cybersecurity-Skills

Analyzes malware command-and-control (C2) communication by profiling protocols, beaconing behavior, and payload structure to inform detection, reverse engineering, and threat intelligence workflows.

Cyber Kill Chain Analysis

analyzing-cyber-kill-chain

mukul975/Anthropic-Cybersecurity-Skills

Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain to map completed phases, detection outcomes, and defensive courses of action for incident response, threat reporting, and control planning.

DNS Exfiltration Detection

analyzing-dns-logs-for-exfiltration

mukul975/Anthropic-Cybersecurity-Skills

Scans DNS query logs within SIEM platforms to flag data exfiltration by spotting suspicious tunneling subdomains, high-entropy DGA-style domains, and abnormal query volumes, helping SOC teams uncover DNS-based threats evading standard controls.

Malware Covert Channel Detection

analyzing-network-covert-channels-in-malware

mukul975/Anthropic-Cybersecurity-Skills

Analyzes malware covert channels such as DNS tunneling, ICMP exfiltration, steganographic HTTP, and protocol abuse via Python/PCAP inspection so incident responders can flag suspicious domains and flows during threat hunting.

PowerShell Empire Detection

analyzing-powershell-empire-artifacts

mukul975/Anthropic-Cybersecurity-Skills

Scans Windows Script Block and Module Logging events to spot PowerShell Empire launchers, Base64 loaders, staging URLs, user agents, and module invocations so threat hunters can flag persistence or C2 activity quickly.

MITRE ATT&CK TTP Mapping

analyzing-threat-actor-ttps-with-mitre-attack

mukul975/Anthropic-Cybersecurity-Skills

Map threat actors to the MITRE ATT&CK framework, build ATT&CK Navigator technique coverage layers, identify detection gaps, and link observed IOCs to adversary tactics across Enterprise, Mobile, and ICS matrices for actionable reporting.

Mapping APT TTPs With Navigator

analyzing-threat-actor-ttps-with-mitre-navigator

mukul975/Anthropic-Cybersecurity-Skills

Programmatically maps APT group tactics, techniques, and procedures to MITRE ATT&CK via attackcti and the ATT&CK Navigator, generating layer JSON files, overlaying detection coverage, and sharing visualizations for defense teams.

Splunk Windows Threat Detection

analyzing-windows-event-logs-in-splunk

mukul975/Anthropic-Cybersecurity-Skills

Runs SPL queries against Windows Security, System, and Sysmon logs in Splunk to flag authentication attacks, privilege escalations, persistence, and lateral movement, helping SOC analysts, detection engineers, and responders build investigations and timelines.

Cloud SIEM With Sentinel

building-cloud-siem-with-sentinel

mukul975/Anthropic-Cybersecurity-Skills

Deploy Microsoft Sentinel as a cloud-native SIEM and SOAR platform, configure multi-cloud connectors, author KQL detection rules, and automate incident responses to support centralized SOC threat hunting.

Splunk SPL Detection Rules

building-detection-rule-with-splunk-spl

mukul975/Anthropic-Cybersecurity-Skills

Guide for building Splunk Search Processing Language correlation searches that identify SOC threats, enrich events, configure notable alerts, and close MITRE ATT&CK coverage gaps in Enterprise Security deployments.

Language