Download

Skill UI

Browse and discover 6044+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search threat-detection , found 45 results

Default Newest Most Downloaded

Zeek Network Anomaly Detection

detecting-network-anomalies-with-zeek

mukul975/Anthropic-Cybersecurity-Skills

Deploys Zeek to passively monitor network traffic, emit structured connection/DNS/HTTP/SSL logs, and run custom scripts that flag anomalous behavior for threat hunting and incident response teams.

IDS Network Scan Detection

detecting-network-scanning-with-ids-signatures

mukul975/Anthropic-Cybersecurity-Skills

Detect reconnaissance tools such as Nmap and Masscan using Suricata/Snort IDS signatures, thresholds, and anomaly cues to alert on TCP/UDP scans, SYN/ACK probes, and other scan fingerprints before threat actors escalate.

Detecting Pass-The-Ticket

detecting-pass-the-ticket-attacks

mukul975/Anthropic-Cybersecurity-Skills

Analyze Windows Event IDs 4768, 4769, and 4771 within Splunk or Elastic SIEM to identify anomalous Kerberos ticket usage, RC4 downgrades, and unusual service requests, enabling proactive Pass-the-Ticket threat detection.

Process Hollowing Detection

detecting-process-hollowing-technique

mukul975/Anthropic-Cybersecurity-Skills

Detect process hollowing (T1055.012) by analyzing EDR telemetry for suspended process creation, memory section anomalies, integrity mismatches, and correlated network evidence to hunt for in-memory threats and proactive defense.

Ransomware Network Precursors Detection

detecting-ransomware-precursors-in-network

mukul975/Anthropic-Cybersecurity-Skills

Identifies early-stage ransomware indicators in Zeek/Suricata/Arkime traffic, correlates with SIEM rules and threat feeds, and alerts on Cobalt Strike beacons, Mimikatz signatures, RDP brute-force and staging behaviors before encryption begins.

Sysmon Injection Detection

detecting-t1055-process-injection-with-sysmon

mukul975/Anthropic-Cybersecurity-Skills

Detects MITRE T1055 process injection techniques by correlating Sysmon events for remote thread creation, suspicious process access, anomalous DLL loading, and process hollowing to validate detections and feed SIEM alerts in threat-hunting workflows.

Elevation Control Abuse Detection

detecting-t1548-abuse-elevation-control-mechanism

mukul975/Anthropic-Cybersecurity-Skills

Detect T1548 elevation control abuse by monitoring UAC bypass registry tweaks, auto-elevating binaries, process integrity jumps, and Linux setuid/sudo misuse, enabling threat hunters to spot credential-free privilege escalation chains across Windows and Linux.

WMI Persistence Detection

detecting-wmi-persistence

mukul975/Anthropic-Cybersecurity-Skills

Detect WMI subscription persistence by analyzing Sysmon Event IDs 19, 20, and 21 for malicious filters, consumers, and bindings, enabling threat hunters to validate telemetry, prioritize follow-up, and remediate attacker persistence.

IOC Extraction From Malware

extracting-iocs-from-malware-samples

mukul975/Anthropic-Cybersecurity-Skills

Processes malware samples to extract file, network, host, and behavioral indicators for sharing threat intelligence, building blocklists, and crafting detection signatures from validated analysis artifacts.

Spearphishing Threat Hunt

hunting-for-spearphishing-indicators

mukul975/Anthropic-Cybersecurity-Skills

Guide on hunting spearphishing indicators across email logs, endpoint telemetry, and network data with workflows, tools, scenarios, and output formats for proactive campaign detection and response.

Webshell Hunting Workflow

hunting-for-webshell-activity

mukul975/Anthropic-Cybersecurity-Skills

Hunt for web shell deployments on internet-facing servers by analyzing file writes, spawned processes, and HTTP anomalies; use this guide during proactive threat-hunting, incident response, and SIEM/EDR detection tuning.

LOLBAS Detection Rules

hunting-living-off-the-land-binaries

mukul975/Anthropic-Cybersecurity-Skills

Monitors Windows process creation events to flag Living Off The Land Binary abuse by matching Event ID 4688/Sysmon 1 logs against LOLBAS database entries, supporting threat hunting and SIEM rule creation for fileless attacks.

Prev 1 234 Next

Language