Download

Skill UI

Browse and discover 6004+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search threat-hunting , found 31 results

Default Newest Most Downloaded

Yara Rule Authoring

sickn33/antigravity-awesome-skills

Yara Authoring helps security teams write precise YARA rules for threat detection and malware hunting by guiding string/tag management and metadata handling so signature creation keeps pace with investigations.

Azure Activity Threat Hunting

analyzing-azure-activity-logs-for-threats

mukul975/Anthropic-Cybersecurity-Skills

Executes Azure Monitor activity and sign-in log queries using azure-monitor-query to spot suspicious admin operations, impossible travel, privilege escalation, and resource changes, supporting incident investigations and cloud SIEM detections.

Malware Covert Channel Detection

analyzing-network-covert-channels-in-malware

mukul975/Anthropic-Cybersecurity-Skills

Analyzes malware covert channels such as DNS tunneling, ICMP exfiltration, steganographic HTTP, and protocol abuse via Python/PCAP inspection so incident responders can flag suspicious domains and flows during threat hunting.

Cloud SIEM With Sentinel

building-cloud-siem-with-sentinel

mukul975/Anthropic-Cybersecurity-Skills

Deploy Microsoft Sentinel as a cloud-native SIEM and SOAR platform, configure multi-cloud connectors, author KQL detection rules, and automate incident responses to support centralized SOC threat hunting.

Threat Hunt Hypothesis

building-threat-hunt-hypothesis-framework

mukul975/Anthropic-Cybersecurity-Skills

Establishes a systematic process that turns threat intelligence, ATT&CK gaps, and telemetry into testable hunting hypotheses, guiding analysts through data selection, query execution, and reporting for proactive detection and response.

Deploy Osquery Endpoint Monitoring

deploying-osquery-for-endpoint-monitoring

mukul975/Anthropic-Cybersecurity-Skills

Guides deploying and configuring osquery agents across Windows, macOS, and Linux to gain SQL-based visibility into running processes, ports, installed software, and compliance state for fleet monitoring, threat hunting, and SIEM integration.

Beaconing Detection with Zeek

detecting-beaconing-patterns-with-zeek

mukul975/Anthropic-Cybersecurity-Skills

Loads Zeek conn.log via ZAT into Pandas to analyze connection intervals, computing jitter and flagging low-std periodic flows to catch C2 beaconing during network threat hunting.

Insider Threat Detection

detecting-insider-threat-behaviors

mukul975/Anthropic-Cybersecurity-Skills

Detects insider threat behaviors by hunting for unusual data access, privilege abuse, mass downloads, and resignation-linked exfiltration across EDR, SIEM, and intelligence sources to guide incident response actions.

Mimikatz Execution Detection

detecting-mimikatz-execution-patterns

mukul975/Anthropic-Cybersecurity-Skills

Detect execution patterns of Mimikatz by correlating command-line signatures, LSASS access anomalies, binary indicators, and in-memory modules across EDR and SIEM telemetry, supporting proactive threat hunting and incident response.

Zeek Network Anomaly Detection

detecting-network-anomalies-with-zeek

mukul975/Anthropic-Cybersecurity-Skills

Deploys Zeek to passively monitor network traffic, emit structured connection/DNS/HTTP/SSL logs, and run custom scripts that flag anomalous behavior for threat hunting and incident response teams.

Sysmon Injection Detection

detecting-t1055-process-injection-with-sysmon

mukul975/Anthropic-Cybersecurity-Skills

Detects MITRE T1055 process injection techniques by correlating Sysmon events for remote thread creation, suspicious process access, anomalous DLL loading, and process hollowing to validate detections and feed SIEM alerts in threat-hunting workflows.

Advanced Threat Hunting

hunting-advanced-persistent-threats

mukul975/Anthropic-Cybersecurity-Skills

Hunt for Advanced Persistent Threats across endpoints, network logs, and memory using MITRE ATT&CK hypotheses, Velociraptor/osquery queries, and SIEM pivots to validate threats or gaps before escalation.

Language