Security & Compliance Skills
902 curated security and compliance skills for AI coding agents. Access control, vulnerability scanning, compliance audit - all license-verified.
Contract Review
Analyze contracts for risks, check completeness, and provide actionable recommendations. Supports employment contracts, NDAs, service agreements, and more.
by claude-office-skills/skills / contract-review
Correlating Security Events In Qradar
Correlates security events in IBM QRadar SIEM using AQL (Ariel Query Language), custom rules, building blocks, and offense management to detect multi-stage attacks across network, endpoint, and application log sources. Use when SOC analysts need to investigate QRadar offenses, build correlation rules, or tune detection logic for reducing false positives.
by mukul975/Anthropic-Cybersecurity-Skills / skills/correlating-security-events-in-qradar
Correlating Threat Campaigns
Correlates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify unified threat campaigns, attribute them to common threat actors, and extract shared indicators for improved detection. Use when multiple incidents exhibit overlapping indicators, when sector-wide attack campaigns require cross-organizational analysis, or when building campaign-level intelligence products. Activates for requests involving campaign analysis, incident clustering, cross-organizational IOC correlation, or MISP correlation engine.
by mukul975/Anthropic-Cybersecurity-Skills / skills/correlating-threat-campaigns
Credentials
Centralized API key management from Access.txt
by alinaqi/maggy / skills/credentials
Crypt
Designing cryptographic architecture: algorithm selection, key management, E2EE, KMS integration, signature verification, and TLS configuration. Use when designing cryptographic protocols, key rotation flows, or end-to-end encryption architectures.
by simota/agent-skills / crypt
Data Breach Blast Radius
Pre-breach impact analysis: inventories sensitive data (PII, PHI, PCI-DSS, credentials), traces data flows, scores exposure vectors, and produces a regulatory blast radius report with fine ranges sourced verbatim from GDPR Art. 83, CCPA § 1798.155(a), and HIPAA 45 CFR § 160.404. Cost benchmarks from IBM Cost of a Data Breach Report (annually updated). All citations in references/SOURCES.md for verification. Use when asked: "assess breach impact", "what data could be exposed", "calculate blast radius", "data exposure analysis", "how bad would a breach be", "quantify data risk", "sensitive data inventory", "data flow security audit", "pre-breach assessment", "worst-case breach scenario", "breach readiness", "data risk report", "/data-breach-blast-radius". For any stack handling user data, health records, or financial information. Output labels law-sourced figures (exact) vs heuristic estimates (planning only). Does not replace legal counsel.
by github/awesome-copilot / skills/data-breach-blast-radius
Defender Scout KQL
Generates, validates, and optimizes KQL queries for Microsoft Defender XDR Advanced Hunting across Endpoint, Identity, Office 365, Cloud Apps, and Identity.
by github/awesome-copilot / agents/defender-scout-kql.agent.md
Deobfuscating Javascript Malware
Deobfuscates malicious JavaScript code used in web-based attacks, phishing pages, and dropper scripts by reversing encoding layers, eval chains, string manipulation, and control flow obfuscation to reveal the original malicious logic. Activates for requests involving JavaScript malware analysis, script deobfuscation, web skimmer analysis, or obfuscated dropper investigation.
by mukul975/Anthropic-Cybersecurity-Skills / skills/deobfuscating-javascript-malware
Deobfuscating Powershell Obfuscated Malware
Systematically deobfuscate multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure.
by mukul975/Anthropic-Cybersecurity-Skills / skills/deobfuscating-powershell-obfuscated-malware
Dependency Track
Comprehensive guide for Dependency-Track - Software Composition Analysis (SCA) and SBOM management platform. USE WHEN deploying Dependency-Track, integrating with CI/CD pipelines, configuring vulnerability scanning, managing SBOMs, setting up policy compliance, troubleshooting installation issues, or working with the REST API.
by julianobarbosa/claude-code-skills / skills/dependency-track
Dependency Vulnerability Scanning Skill
Scan repository dependencies for known vulnerabilities using the GitHub MCP Server's Dependabot toolset and the GitHub Advisory Database. Use when asked to check dependency security, audit lockfiles, or verify packages before merging.
by github/copilot-plugins / plugins/advanced-security/skills/dependency-scanning
Deploying Active Directory Honeytokens
Deploys deception-based honeytokens in Active Directory including fake privileged accounts with AdminCount=1, fake SPNs for Kerberoasting detection (honeyroasting), decoy GPOs with cpassword traps, and fake BloodHound paths. Monitors Windows Security Event IDs 4769, 4625, 4662, 5136 for honeytoken interaction. Use when implementing AD deception defenses for detecting lateral movement, credential theft, and reconnaissance.
by mukul975/Anthropic-Cybersecurity-Skills / skills/deploying-active-directory-honeytokens
Deploying Cloudflare Access For Zero Trust
Deploying Cloudflare Access with Cloudflare Tunnel to provide zero trust access to self-hosted and private applications, configuring identity-aware access policies, device posture checks, and WARP client enrollment for VPN replacement.
by mukul975/Anthropic-Cybersecurity-Skills / skills/deploying-cloudflare-access-for-zero-trust
Deploying Decoy Files For Ransomware Detection
Deploys canary files (honeytokens) across file systems to detect ransomware encryption activity in real time. Uses strategically placed decoy documents monitored via file integrity monitoring or OS-level watchdogs to trigger alerts when ransomware modifies or encrypts them. Activates for requests involving ransomware canary deployment, honeyfile setup, deception-based ransomware detection, or file integrity monitoring for encryption.
by mukul975/Anthropic-Cybersecurity-Skills / skills/deploying-decoy-files-for-ransomware-detection
Deploying Edr Agent With Crowdstrike
Deploys and configures CrowdStrike Falcon EDR agents across enterprise endpoints to enable real-time threat detection, behavioral analysis, and automated response. Use when onboarding endpoints to EDR coverage, configuring detection policies, or integrating Falcon telemetry with SIEM platforms. Activates for requests involving CrowdStrike deployment, Falcon sensor installation, EDR policy configuration, or endpoint detection and response.
by mukul975/Anthropic-Cybersecurity-Skills / skills/deploying-edr-agent-with-crowdstrike
Deploying Osquery For Endpoint Monitoring
Deploys and configures osquery for real-time endpoint monitoring using SQL-based queries to inspect running processes, open ports, installed software, and system configuration. Use when building visibility into endpoint state, threat hunting across fleet, or implementing compliance monitoring. Activates for requests involving osquery deployment, endpoint visibility, fleet management, or SQL-based endpoint querying.
by mukul975/Anthropic-Cybersecurity-Skills / skills/deploying-osquery-for-endpoint-monitoring
Deploying Palo Alto Prisma Access Zero Trust
Deploying Palo Alto Networks Prisma Access for SASE-based zero trust network access using GlobalProtect agents, ZTNA Connectors, security policy enforcement, and integration with Strata Cloud Manager for unified security management.
by mukul975/Anthropic-Cybersecurity-Skills / skills/deploying-palo-alto-prisma-access-zero-trust
Deploying Ransomware Canary Files
Deploys and monitors ransomware canary files across critical directories using Python's watchdog library for real-time filesystem event detection. Places strategically named decoy files that mimic high-value targets (financial records, credentials, database exports) in locations ransomware typically enumerates first. Monitors for any read, modify, rename, or delete operations on canary files and triggers immediate alerts via email, Slack webhook, or syslog when interaction is detected, providing early warning before full encryption begins.
by mukul975/Anthropic-Cybersecurity-Skills / skills/deploying-ransomware-canary-files
Deploying Software Defined Perimeter
Deploy a Software-Defined Perimeter using the CSA v2.0 specification with Single Packet Authorization, mutual TLS, and SDP controller/gateway configuration to enforce zero trust network access.
by mukul975/Anthropic-Cybersecurity-Skills / skills/deploying-software-defined-perimeter
Deploying Tailscale For Zero Trust Vpn
Deploy and configure Tailscale as a WireGuard-based zero trust mesh VPN with identity-aware access controls, ACLs, and exit nodes for secure peer-to-peer connectivity.
by mukul975/Anthropic-Cybersecurity-Skills / skills/deploying-tailscale-for-zero-trust-vpn
Detecting AI Model Prompt Injection Attacks
Detects prompt injection attacks targeting LLM-based applications using a multi-layered defense combining regex pattern matching for known attack signatures, heuristic scoring for structural anomalies, and transformer-based classification with DeBERTa models. The detector analyzes user inputs before they reach the LLM, flagging direct injections (system prompt overrides, role-play escapes, instruction hijacking) and indirect injections (encoded payloads, multi-language obfuscation, delimiter-based escapes). Based on the OWASP LLM Top 10 (LLM01:2025 Prompt Injection) and Simon Willison's prompt injection taxonomy. Activates for requests involving prompt injection detection, LLM input sanitization, AI security scanning, or prompt attack classification.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-ai-model-prompt-injection-attacks
Detecting Anomalies In Industrial Control Systems
This skill covers deploying anomaly detection systems for industrial control environments using machine learning models trained on OT network baselines, physics-based process models, and behavioral analysis of industrial protocol communications. It addresses building normal behavior profiles for SCADA polling patterns, detecting deviations in Modbus/DNP3/OPC UA traffic, identifying rogue devices, and correlating network anomalies with physical process data from historians.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-anomalies-in-industrial-control-systems
Detecting Anomalous Authentication Patterns
Detects anomalous authentication patterns using UEBA analytics, statistical baselines, and machine learning models to identify impossible travel, credential stuffing, brute force, password spraying, and compromised account behaviors across authentication logs. Activates for requests involving authentication anomaly detection, login behavior analysis, UEBA implementation, or suspicious sign-in investigation.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-anomalous-authentication-patterns
Detecting API Enumeration Attacks
Detect and prevent API enumeration attacks including BOLA and IDOR exploitation by monitoring sequential identifier access patterns and authorization failures.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-api-enumeration-attacks
Detecting Arp Poisoning In Network Traffic
Detect and prevent ARP spoofing attacks using ARPWatch, Dynamic ARP Inspection, Wireshark analysis, and custom monitoring scripts to protect against man-in-the-middle interception.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-arp-poisoning-in-network-traffic
Detecting Attacks On Historian Servers
Detect cyber attacks targeting OT historian servers (OSIsoft PI, Ignition, Wonderware) that sit at the IT/OT boundary and serve as pivot points for lateral movement between enterprise and control networks, including data manipulation, unauthorized queries, and exploitation of historian-specific vulnerabilities.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-attacks-on-historian-servers
Detecting Attacks On Scada Systems
This skill covers detecting cyber attacks targeting Supervisory Control and Data Acquisition (SCADA) systems including man-in-the-middle attacks on industrial protocols, unauthorized command injection into PLCs, HMI compromise, historian data manipulation, and denial-of-service against control system communications. It leverages OT-specific intrusion detection systems, industrial protocol anomaly detection, and process data analytics to identify attacks that traditional IT security tools miss.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-attacks-on-scada-systems
Detecting AWS Cloudtrail Anomalies
Detect unusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis to identify credential compromise, privilege escalation, and unauthorized resource access.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-aws-cloudtrail-anomalies
Detecting AWS Credential Exposure With Trufflehog
Detecting exposed AWS credentials in source code repositories, CI/CD pipelines, and configuration files using TruffleHog, git-secrets, and AWS-native detection mechanisms to prevent credential theft and unauthorized account access.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-aws-credential-exposure-with-trufflehog
Detecting AWS Guardduty Findings Automation
Automate AWS GuardDuty threat detection findings processing using EventBridge and Lambda to enable real-time incident response, automatic quarantine of compromised resources, and security notification workflows.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-aws-guardduty-findings-automation
Detecting AWS Iam Privilege Escalation
Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive policies, dangerous permission combinations, and least-privilege violations
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-aws-iam-privilege-escalation
Detecting Azure Lateral Movement
Detect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomaly correlation to identify privilege escalation, token theft, and cross-tenant pivoting.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-azure-lateral-movement
Detecting Azure Service Principal Abuse
Detect and investigate Azure service principal abuse including privilege escalation, credential compromise, admin consent bypass, and unauthorized enumeration in Microsoft Entra ID environments.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-azure-service-principal-abuse
Detecting Azure Storage Account Misconfigurations
Audit Azure Blob and ADLS storage accounts for public access exposure, weak or long-lived SAS tokens, missing encryption at rest, disabled HTTPS-only traffic, and outdated TLS versions using the azure-mgmt-storage Python SDK.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-azure-storage-account-misconfigurations
Detecting Beaconing Patterns with Zeek
'Performs statistical analysis of Zeek conn.log connection intervals to detect C2 beaconing patterns. Uses the
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-beaconing-patterns-with-zeek
Detecting Bluetooth Low Energy Attacks
Detects and analyzes Bluetooth Low Energy (BLE) security attacks including sniffing, replay attacks, GATT enumeration abuse, and Man-in-the-Middle interception. Uses Ubertooth One and nRF52840 sniffers for packet capture, the bleak Python library for GATT service enumeration, and crackle for BLE encryption cracking. Use when assessing IoT device BLE security, monitoring for BLE-based attacks on wireless infrastructure, or performing authorized BLE penetration testing. Activates for requests involving BLE security assessment, Ubertooth sniffing, GATT enumeration, or BLE replay detection.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-bluetooth-low-energy-attacks
Detecting Broken Object Property Level Authorization
Detect and test for OWASP API3:2023 Broken Object Property Level Authorization vulnerabilities including excessive data exposure and mass assignment attacks.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-broken-object-property-level-authorization
Detecting Business Email Compromise
Business Email Compromise (BEC) is a sophisticated fraud scheme where attackers impersonate executives, vendors, or trusted partners to trick employees into transferring funds, sharing sensitive data,
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-business-email-compromise
Detecting Business Email Compromise with AI
Deploy AI and NLP-powered detection systems to identify business email compromise attacks by analyzing writing
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-business-email-compromise-with-ai
Detecting Cloud Threats With Guardduty
This skill teaches security teams how to deploy and operationalize Amazon GuardDuty for continuous threat detection across AWS accounts and workloads. It covers enabling protection plans for S3, EKS, EC2 runtime monitoring, and Lambda, interpreting finding severity levels, and building automated response workflows using EventBridge and Lambda.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-cloud-threats-with-guardduty
Detecting Command And Control Over DNS
Detects command-and-control (C2) communications tunneled through DNS protocol including DNS tunneling tools (Iodine, dnscat2, dns2tcp, Cobalt Strike DNS beacon), domain generation algorithms (DGA), encoded payload delivery via TXT/CNAME records, and DNS beaconing patterns. Covers Shannon entropy analysis of query subdomains, statistical anomaly detection, ML-based DGA classification, passive DNS correlation, and Zeek/Suricata signature development. Activates for requests involving DNS-based C2 detection, DNS tunnel identification, suspicious DNS traffic investigation, or DGA domain classification.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-command-and-control-over-dns
Detecting Compromised Cloud Credentials
Detecting compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible travel patterns, unauthorized resource provisioning, and credential abuse indicators using GuardDuty, Defender for Identity, and SCC Event Threat Detection.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-compromised-cloud-credentials
Detecting Container Drift At Runtime
Detect unauthorized modifications to running containers by monitoring for binary execution drift, file system changes, and configuration deviations from the original container image.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-container-drift-at-runtime
Detecting Container Escape Attempts
Container escape is a critical attack technique where an adversary breaks out of container isolation to access the host system or other containers. Detection involves monitoring for escape indicators
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-container-escape-attempts
Detecting Container Escape With Falco Rules
Detect container escape attempts in real-time using Falco runtime security rules that monitor syscalls, file access, and privilege escalation.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-container-escape-with-falco-rules
Detecting Credential Dumping Techniques
Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft using Sysmon Event ID 10, Windows Security logs, and SIEM correlation rules
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-credential-dumping-techniques
Detecting Cryptomining In Cloud
This skill teaches security teams how to detect and respond to unauthorized cryptocurrency mining operations in cloud environments. It covers identifying cryptomining indicators through compute usage anomalies, network traffic patterns to mining pools, GuardDuty CryptoCurrency findings, and runtime process monitoring on EC2, ECS, EKS, and Azure Automation workloads.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-cryptomining-in-cloud
Detecting Dcsync Attack In Active Directory
Detect DCSync attacks where adversaries abuse Active Directory replication privileges to extract password hashes by monitoring for non-domain-controller accounts requesting directory replication via DsGetNCChanges.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-dcsync-attack-in-active-directory
Detecting Deepfake Audio In Vishing Attacks
Detects AI-generated deepfake audio used in voice phishing (vishing) attacks by extracting spectral features (MFCC, spectral centroid, spectral contrast, zero-crossing rate) and classifying samples with machine learning models. Supports batch analysis of audio files, generates confidence scores, and produces forensic reports. Activates for requests involving deepfake voice detection, vishing investigation, AI-generated speech analysis, voice cloning detection, or audio authenticity verification.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-deepfake-audio-in-vishing-attacks
Detecting Dll Sideloading Attacks
Detect DLL side-loading attacks where adversaries place malicious DLLs alongside legitimate applications to hijack execution flow for defense evasion.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-dll-sideloading-attacks
Detecting Dnp3 Protocol Anomalies
Detect anomalies in DNP3 (Distributed Network Protocol 3) communications used in SCADA systems by monitoring for unauthorized control commands, firmware update attempts, protocol violations, and deviations from baseline traffic patterns using deep packet inspection and machine learning approaches.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-dnp3-protocol-anomalies
Detecting DNS Exfiltration With DNS Query Analysis
Detect data exfiltration through DNS tunneling by analyzing query entropy, subdomain length, query volume, TXT record abuse, and response payload sizes using passive DNS monitoring.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-dns-exfiltration-with-dns-query-analysis
Detecting Email Account Compromise
Detect compromised O365 and Google Workspace email accounts by analyzing inbox rule creation, suspicious sign-in locations, mail forwarding rules, and unusual API access patterns via Microsoft Graph and audit logs.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-email-account-compromise
Detecting Email Forwarding Rules Attack
Detect malicious email forwarding rules created by adversaries to maintain persistent access to email communications for intelligence collection and BEC attacks.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-email-forwarding-rules-attack
Detecting Evasion Techniques In Endpoint Logs
Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-evasion-techniques-in-endpoint-logs
Detecting Exfiltration Over DNS With Zeek
Detect DNS-based data exfiltration by analyzing Zeek dns.log for high-entropy subdomains and anomalous query patterns
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-exfiltration-over-dns-with-zeek
Detecting Fileless Attacks On Endpoints
Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. Use when building detections for PowerShell-based attacks, reflective DLL injection, WMI persistence, and registry-resident malware. Activates for requests involving fileless malware detection, in-memory attacks, PowerShell exploitation, or living-off-the-land techniques.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-fileless-attacks-on-endpoints
Detecting Fileless Malware Techniques
Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living-off-the-land binaries (LOLBins) without writing traditional executable files to disk. Activates for requests involving fileless threat detection, in-memory malware investigation, LOLBin abuse analysis, or WMI persistence examination.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-fileless-malware-techniques
Detecting Golden Ticket Attacks In Kerberos Logs
Detect Golden Ticket attacks in Active Directory by analyzing Kerberos TGT anomalies including mismatched encryption types, impossible ticket lifetimes, non-existent accounts, and forged PAC signatures in domain controller event logs.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-golden-ticket-attacks-in-kerberos-logs
Detecting Golden Ticket Forgery
Detect Kerberos Golden Ticket forgery by analyzing Windows Event ID 4769 for RC4 encryption downgrades (0x17), abnormal ticket lifetimes, and krbtgt account anomalies in Splunk and Elastic SIEM
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-golden-ticket-forgery
Detecting Insider Data Exfiltration via DLP
'Detects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload volume anomalies,
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-insider-data-exfiltration-via-dlp
Detecting Insider Threat Behaviors
Detect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads,
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-insider-threat-behaviors
Detecting Insider Threat With Ueba
Implement User and Entity Behavior Analytics using Elasticsearch/OpenSearch to build behavioral baselines, calculate anomaly scores, perform peer group analysis, and detect insider threat indicators such as data exfiltration, privilege abuse, and unauthorized access patterns.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-insider-threat-with-ueba
Detecting Kerberoasting Attacks
Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests targeting service accounts with SPNs for offline password cracking.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-kerberoasting-attacks
Detecting Lateral Movement In Network
Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zeek, Velociraptor, and SIEM correlation rules to detect attackers moving between systems.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-lateral-movement-in-network
Detecting Lateral Movement With Splunk
Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service abuse.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-lateral-movement-with-splunk
Detecting Lateral Movement With Zeek
Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, NTLM account spray activity, remote service execution, and anomalous internal connections.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-lateral-movement-with-zeek
Detecting Living Off The Land Attacks
Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process creation, command-line arguments, and parent-child relationships to identify suspicious LOLBin execution patterns.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-living-off-the-land-attacks
Detecting Living Off The Land With Lolbas
Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including certutil, regsvr32, mshta, and rundll32 via process telemetry, Sigma rules, and parent-child process analysis
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-living-off-the-land-with-lolbas
Detecting Malicious Scheduled Tasks With Sysmon
Detect malicious scheduled task creation and modification using Sysmon Event IDs 1 (Process Create for schtasks.exe), 11 (File Create for task XML), and Windows Security Event 4698/4702. The analyst correlates task creation with suspicious parent processes, public directory paths, and encoded command arguments to identify persistence and lateral movement via scheduled tasks. Activates for requests involving scheduled task detection, Sysmon persistence hunting, or T1053.005 Scheduled Task/Job analysis.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-malicious-scheduled-tasks-with-sysmon
Detecting Mimikatz Execution Patterns
Detect Mimikatz execution through command-line patterns, LSASS access signatures, binary indicators, and in-memory detection of known modules.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-mimikatz-execution-patterns
Detecting Misconfigured Azure Storage
Detecting misconfigured Azure Storage accounts including publicly accessible blob containers, missing encryption settings, overly permissive SAS tokens, disabled logging, and network access violations using Azure CLI, PowerShell, and Microsoft Defender for Storage.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-misconfigured-azure-storage
Detecting Mobile Malware Behavior
Detects and analyzes malicious behavior in mobile applications through behavioral analysis, permission abuse detection, network traffic monitoring, and dynamic instrumentation. Use when analyzing suspicious mobile applications for data exfiltration, command-and-control communication, credential stealing, SMS interception, or other malware indicators. Activates for requests involving mobile malware analysis, app behavior monitoring, trojan detection, or suspicious app investigation.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-mobile-malware-behavior
Detecting Modbus Command Injection Attacks
Detect command injection attacks against Modbus TCP/RTU protocol in ICS environments by monitoring for unauthorized write operations, anomalous function codes, malformed frames, and deviations from established communication baselines using ICS-aware IDS and protocol deep packet inspection.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-modbus-command-injection-attacks
Detecting Modbus Protocol Anomalies
This skill covers detecting anomalies in Modbus/TCP and Modbus RTU communications in industrial control systems. It addresses function code monitoring, register range validation, timing analysis, unauthorized client detection, and deep packet inspection for malformed Modbus frames. The skill leverages Zeek with Modbus protocol analyzers, Suricata IDS with OT rules, and custom Python-based detection using Markov chain models for normal Modbus transaction sequences.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-modbus-protocol-anomalies
Detecting Network Anomalies With Zeek
Deploys and configures Zeek (formerly Bro) network security monitor to passively analyze network traffic, generate structured logs, detect anomalous behavior, and create custom detection scripts for threat hunting and incident response.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-network-anomalies-with-zeek
Detecting Network Scanning With Ids Signatures
Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures, threshold-based detection rules, and traffic anomaly analysis to identify Nmap, Masscan, and custom scanning activity.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-network-scanning-with-ids-signatures
Detecting Ntlm Relay With Event Correlation
Detect NTLM relay attacks through Windows Security Event correlation by analyzing Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, auditing SMB and LDAP signing enforcement across the domain, and detecting NTLM downgrade attacks from NTLMv2 to NTLMv1 using event log analysis.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-ntlm-relay-with-event-correlation
Detecting OAuth Token Theft
Detects and responds to OAuth token theft and replay attacks in cloud environments, focusing on Microsoft Entra ID (Azure AD) token protection, conditional access policies, and sign-in anomaly detection. Covers access token theft, refresh token replay, Primary Refresh Token (PRT) abuse, and pass-the-cookie attacks. Activates for requests involving OAuth token theft detection, token replay prevention, Azure AD conditional access token protection, or cloud identity attack investigation.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-oauth-token-theft
Detecting Pass The Hash Attacks
Detect Pass-the-Hash attacks by analyzing NTLM authentication patterns, identifying Type 3 logons with NTLM where Kerberos is expected, and correlating with credential dumping.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-pass-the-hash-attacks
Detecting Pass-the-Ticket Attacks
Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-pass-the-ticket-attacks
Detecting Port Scanning With Fail2ban
Configures Fail2ban with custom filters and actions to detect port scanning activity, SSH brute force attempts, and network reconnaissance, automatically banning offending IP addresses and alerting security teams to suspicious network probing.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-port-scanning-with-fail2ban
Detecting Privilege Escalation Attempts
Detect privilege escalation attempts including token manipulation, UAC bypass, unquoted service paths, kernel
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-privilege-escalation-attempts
Detecting Privilege Escalation In Kubernetes Pods
Detect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-privilege-escalation-in-kubernetes-pods
Detecting Process Hollowing Technique
Detect process hollowing (T1055.012) by analyzing memory-mapped sections, hollowed process indicators, and parent-child process anomalies in EDR telemetry.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-process-hollowing-technique
Detecting Process Injection Techniques
Detects and analyzes process injection techniques used by malware including classic DLL injection, process hollowing, APC injection, thread hijacking, and reflective loading. Uses memory forensics, API monitoring, and behavioral analysis to identify injection artifacts. Activates for requests involving process injection detection, code injection analysis, hollowed process investigation, or in-memory threat detection.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-process-injection-techniques
Detecting Qr Code Phishing With Email Security
Detect and prevent QR code phishing (quishing) attacks that bypass traditional email security by embedding malicious URLs in QR code images within emails.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-qr-code-phishing-with-email-security
Detecting Ransomware Encryption Behavior
Detects ransomware encryption activity in real time using entropy analysis, file system I/O monitoring, and behavioral heuristics. Identifies mass file modification patterns, abnormal entropy spikes in written data, and suspicious process behavior characteristic of ransomware encryption routines. Activates for requests involving ransomware behavioral detection, entropy-based file monitoring, I/O anomaly detection, or real-time encryption activity alerting.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-ransomware-encryption-behavior
Detecting Ransomware Precursors In Network
Detects early-stage ransomware indicators in network traffic before encryption begins, including initial access broker activity, command-and-control beaconing, credential harvesting, reconnaissance scanning, and staging behavior. Uses network detection tools (Zeek, Suricata, Arkime), SIEM correlation rules, and threat intelligence feeds to identify ransomware precursor patterns such as Cobalt Strike beacons, Mimikatz network signatures, and RDP brute-force attempts. Activates for requests involving pre-ransomware detection, network-based ransomware indicators, or early warning ransomware monitoring.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-ransomware-precursors-in-network
Detecting Rdp Brute Force Attacks
Detect RDP brute force attacks by analyzing Windows Security Event Logs for failed authentication patterns (Event ID 4625), successful logons after failures (Event ID 4624), NLA failures, and source IP frequency analysis.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-rdp-brute-force-attacks
Detecting Rootkit Activity
Detects rootkit presence on compromised systems by identifying hidden processes, hooked system calls, modified kernel structures, hidden files, and covert network connections using memory forensics, cross-view detection, and integrity checking techniques. Activates for requests involving rootkit detection, hidden process discovery, kernel integrity checking, or system call hook analysis.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-rootkit-activity
Detecting S3 Data Exfiltration Attempts
Detecting data exfiltration attempts from AWS S3 buckets by analyzing CloudTrail S3 data events, VPC Flow Logs, GuardDuty findings, Amazon Macie alerts, and S3 access patterns to identify unauthorized bulk downloads and cross-account data transfers.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-s3-data-exfiltration-attempts
Detecting Serverless Function Injection
Detects and prevents code injection attacks targeting serverless functions (AWS Lambda, Azure Functions, Google Cloud Functions) through event source poisoning, malicious layer injection, runtime command execution, and IAM privilege escalation via function modification. The analyst combines static analysis of function code, CloudTrail event correlation, runtime behavior monitoring, and IAM policy auditing to identify injection vectors across the expanded serverless attack surface including API Gateway, S3, SQS, DynamoDB Streams, and CloudWatch event triggers. Activates for requests involving Lambda security assessment, serverless injection detection, function event poisoning analysis, or serverless privilege escalation investigation.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-serverless-function-injection
Detecting Service Account Abuse
Detect abuse of service accounts through anomalous interactive logons, privilege escalation, lateral movement,
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-service-account-abuse
Detecting Shadow API Endpoints
Discover and inventory shadow API endpoints that operate outside documented specifications using traffic analysis, code scanning, and API discovery platforms.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-shadow-api-endpoints
Detecting Shadow It Cloud Usage
Detect unauthorized SaaS and cloud service usage (shadow IT) by analyzing proxy logs, DNS query logs, and netflow data using Python pandas for traffic pattern analysis and domain classification.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-shadow-it-cloud-usage
Detecting Spearphishing With Email Gateway
Spearphishing targets specific individuals using personalized, researched content that bypasses generic spam filters. Email security gateways (SEGs) like Microsoft Defender for Office 365, Proofpoint,
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-spearphishing-with-email-gateway
Detecting SQL Injection Via Waf Logs
Analyze WAF (ModSecurity/AWS WAF/Cloudflare) logs to detect SQL injection attack campaigns. Parses ModSecurity audit logs and JSON WAF event logs to identify SQLi patterns (UNION SELECT, OR 1=1, SLEEP(), BENCHMARK()), tracks attack sources, correlates multi-stage injection attempts, and generates incident reports with OWASP classification.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-sql-injection-via-waf-logs
Detecting Stuxnet Style Attacks
This skill covers detecting sophisticated cyber-physical attacks that follow the Stuxnet attack pattern of modifying PLC logic while spoofing sensor readings to hide the manipulation from operators. It addresses PLC logic integrity monitoring, physics-based process anomaly detection, engineering workstation compromise indicators, USB-borne attack vectors, and multi-stage attack chain detection spanning IT-to-OT lateral movement through to process manipulation.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-stuxnet-style-attacks
Detecting Supply Chain Attacks In CI CD
Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposure. Uses PyGithub and YAML parsing for automated audit. Use when hardening CI/CD pipelines or investigating compromised build systems.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-supply-chain-attacks-in-ci-cd