Browse Skills — Page 94

detecting-ai-model-prompt-injection-attacks

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-anomalies-in-industrial-control-systems

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-anomalous-authentication-patterns

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-api-enumeration-attacks

mukul975/Anthropic-Cybersecurity-Skills

Detect and prevent API enumeration attacks including BOLA and IDOR exploitation by monitoring sequential identifier access patterns and authorization failures.

detecting-arp-poisoning-in-network-traffic

mukul975/Anthropic-Cybersecurity-Skills

Detect and prevent ARP spoofing attacks using ARPWatch, Dynamic ARP Inspection, Wireshark analysis, and custom monitoring scripts to protect against man-in-the-middle interception.

detecting-attacks-on-historian-servers

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-attacks-on-scada-systems

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-aws-cloudtrail-anomalies

mukul975/Anthropic-Cybersecurity-Skills

Detect unusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis to identify credential compromise, privilege escalation, and unauthorized resource access.

detecting-aws-credential-exposure-with-trufflehog

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-aws-guardduty-findings-automation

mukul975/Anthropic-Cybersecurity-Skills

Automate AWS GuardDuty threat detection findings processing using EventBridge and Lambda to enable real-time incident response, automatic quarantine of compromised resources, and security notification workflows.

detecting-aws-iam-privilege-escalation

mukul975/Anthropic-Cybersecurity-Skills

Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive policies, dangerous permission combinations, and least-privilege violations

detecting-azure-lateral-movement

mukul975/Anthropic-Cybersecurity-Skills

Detect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomaly correlation to identify privilege escalation, token theft, and cross-tenant pivoting.

detecting-azure-service-principal-abuse

mukul975/Anthropic-Cybersecurity-Skills

Detect and investigate Azure service principal abuse including privilege escalation, credential compromise, admin consent bypass, and unauthorized enumeration in Microsoft Entra ID environments.

detecting-azure-storage-account-misconfigurations

mukul975/Anthropic-Cybersecurity-Skills

Audit Azure Blob and ADLS storage accounts for public access exposure, weak or long-lived SAS tokens, missing encryption at rest, disabled HTTPS-only traffic, and outdated TLS versions using the azure-mgmt-storage Python SDK.

detecting-beaconing-patterns-with-zeek

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-bluetooth-low-energy-attacks

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-broken-object-property-level-authorization

mukul975/Anthropic-Cybersecurity-Skills

Detect and test for OWASP API3:2023 Broken Object Property Level Authorization vulnerabilities including excessive data exposure and mass assignment attacks.

detecting-business-email-compromise

mukul975/Anthropic-Cybersecurity-Skills

Business Email Compromise (BEC) is a sophisticated fraud scheme where attackers impersonate executives, vendors, or trusted partners to trick employees into transferring funds, sharing sensitive data,

detecting-business-email-compromise-with-ai

mukul975/Anthropic-Cybersecurity-Skills

Deploy AI and NLP-powered detection systems to identify business email compromise attacks by analyzing writing style, behavioral patterns, and contextual anomalies that evade traditional rule-based filters.

detecting-cloud-threats-with-guardduty

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-command-and-control-over-dns

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-compromised-cloud-credentials

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-container-drift-at-runtime

mukul975/Anthropic-Cybersecurity-Skills

Detect unauthorized modifications to running containers by monitoring for binary execution drift, file system changes, and configuration deviations from the original container image.

detecting-container-escape-attempts

mukul975/Anthropic-Cybersecurity-Skills

Container escape is a critical attack technique where an adversary breaks out of container isolation to access the host system or other containers. Detection involves monitoring for escape indicators

detecting-container-escape-with-falco-rules

mukul975/Anthropic-Cybersecurity-Skills

Detect container escape attempts in real-time using Falco runtime security rules that monitor syscalls, file access, and privilege escalation.

detecting-credential-dumping-techniques

mukul975/Anthropic-Cybersecurity-Skills

Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft using Sysmon Event ID 10, Windows Security logs, and SIEM correlation rules

detecting-cryptomining-in-cloud

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-dcsync-attack-in-active-directory

mukul975/Anthropic-Cybersecurity-Skills

Detect DCSync attacks where adversaries abuse Active Directory replication privileges to extract password hashes by monitoring for non-domain-controller accounts requesting directory replication via DsGetNCChanges.

detecting-deepfake-audio-in-vishing-attacks

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-dll-sideloading-attacks

mukul975/Anthropic-Cybersecurity-Skills

Detect DLL side-loading attacks where adversaries place malicious DLLs alongside legitimate applications to hijack execution flow for defense evasion.

detecting-dnp3-protocol-anomalies

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-dns-exfiltration-with-dns-query-analysis

mukul975/Anthropic-Cybersecurity-Skills

Detect data exfiltration through DNS tunneling by analyzing query entropy, subdomain length, query volume, TXT record abuse, and response payload sizes using passive DNS monitoring.

detecting-email-account-compromise

mukul975/Anthropic-Cybersecurity-Skills

Detect compromised O365 and Google Workspace email accounts by analyzing inbox rule creation, suspicious sign-in locations, mail forwarding rules, and unusual API access patterns via Microsoft Graph and audit logs.

detecting-email-forwarding-rules-attack

mukul975/Anthropic-Cybersecurity-Skills

Detect malicious email forwarding rules created by adversaries to maintain persistent access to email communications for intelligence collection and BEC attacks.

detecting-evasion-techniques-in-endpoint-logs

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-exfiltration-over-dns-with-zeek

mukul975/Anthropic-Cybersecurity-Skills

Detect DNS-based data exfiltration by analyzing Zeek dns.log for high-entropy subdomains and anomalous query patterns

detecting-fileless-attacks-on-endpoints

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-fileless-malware-techniques

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-golden-ticket-attacks-in-kerberos-logs

mukul975/Anthropic-Cybersecurity-Skills

Detect Golden Ticket attacks in Active Directory by analyzing Kerberos TGT anomalies including mismatched encryption types, impossible ticket lifetimes, non-existent accounts, and forged PAC signatures in domain controller event logs.

detecting-golden-ticket-forgery

mukul975/Anthropic-Cybersecurity-Skills

Detect Kerberos Golden Ticket forgery by analyzing Windows Event ID 4769 for RC4 encryption downgrades (0x17), abnormal ticket lifetimes, and krbtgt account anomalies in Splunk and Elastic SIEM

detecting-insider-data-exfiltration-via-dlp

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-insider-threat-behaviors

mukul975/Anthropic-Cybersecurity-Skills

Detect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated data theft.

detecting-insider-threat-with-ueba

mukul975/Anthropic-Cybersecurity-Skills

Implement User and Entity Behavior Analytics using Elasticsearch/OpenSearch to build behavioral baselines, calculate anomaly scores, perform peer group analysis, and detect insider threat indicators such as data exfiltration, privilege abuse, and unauthorized access patterns.

detecting-kerberoasting-attacks

mukul975/Anthropic-Cybersecurity-Skills

Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests targeting service accounts with SPNs for offline password cracking.

detecting-lateral-movement-in-network

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-lateral-movement-with-splunk

mukul975/Anthropic-Cybersecurity-Skills

Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service abuse.

detecting-lateral-movement-with-zeek

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-living-off-the-land-attacks

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-living-off-the-land-with-lolbas

mukul975/Anthropic-Cybersecurity-Skills

Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including certutil, regsvr32, mshta, and rundll32 via process telemetry, Sigma rules, and parent-child process analysis

detecting-malicious-scheduled-tasks-with-sysmon

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-mimikatz-execution-patterns

mukul975/Anthropic-Cybersecurity-Skills

Detect Mimikatz execution through command-line patterns, LSASS access signatures, binary indicators, and in-memory detection of known modules.

detecting-misconfigured-azure-storage

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-mobile-malware-behavior

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-modbus-command-injection-attacks

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-modbus-protocol-anomalies

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-network-anomalies-with-zeek

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-network-scanning-with-ids-signatures

mukul975/Anthropic-Cybersecurity-Skills

Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures, threshold-based detection rules, and traffic anomaly analysis to identify Nmap, Masscan, and custom scanning activity.

detecting-ntlm-relay-with-event-correlation

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-oauth-token-theft

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-pass-the-hash-attacks

mukul975/Anthropic-Cybersecurity-Skills

Detect Pass-the-Hash attacks by analyzing NTLM authentication patterns, identifying Type 3 logons with NTLM where Kerberos is expected, and correlating with credential dumping.

detecting-pass-the-ticket-attacks

mukul975/Anthropic-Cybersecurity-Skills

Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns in Splunk and Elastic SIEM

detecting-port-scanning-with-fail2ban

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-privilege-escalation-attempts

mukul975/Anthropic-Cybersecurity-Skills

Detect privilege escalation attempts including token manipulation, UAC bypass, unquoted service paths, kernel exploits, and sudo/doas abuse across Windows and Linux.

detecting-privilege-escalation-in-kubernetes-pods

mukul975/Anthropic-Cybersecurity-Skills

Detect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.

detecting-process-hollowing-technique

mukul975/Anthropic-Cybersecurity-Skills

Detect process hollowing (T1055.012) by analyzing memory-mapped sections, hollowed process indicators, and parent-child process anomalies in EDR telemetry.

detecting-process-injection-techniques

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-qr-code-phishing-with-email-security

mukul975/Anthropic-Cybersecurity-Skills

Detect and prevent QR code phishing (quishing) attacks that bypass traditional email security by embedding malicious URLs in QR code images within emails.

detecting-ransomware-encryption-behavior

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-ransomware-precursors-in-network

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-rdp-brute-force-attacks

mukul975/Anthropic-Cybersecurity-Skills

Detect RDP brute force attacks by analyzing Windows Security Event Logs for failed authentication patterns (Event ID 4625), successful logons after failures (Event ID 4624), NLA failures, and source IP frequency analysis.

detecting-rootkit-activity

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-s3-data-exfiltration-attempts

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-serverless-function-injection

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-service-account-abuse

mukul975/Anthropic-Cybersecurity-Skills

Detect abuse of service accounts through anomalous interactive logons, privilege escalation, lateral movement, and unauthorized access patterns.

detecting-shadow-api-endpoints

mukul975/Anthropic-Cybersecurity-Skills

Discover and inventory shadow API endpoints that operate outside documented specifications using traffic analysis, code scanning, and API discovery platforms.

detecting-shadow-it-cloud-usage

mukul975/Anthropic-Cybersecurity-Skills

Detect unauthorized SaaS and cloud service usage (shadow IT) by analyzing proxy logs, DNS query logs, and netflow data using Python pandas for traffic pattern analysis and domain classification.

detecting-spearphishing-with-email-gateway

mukul975/Anthropic-Cybersecurity-Skills

Spearphishing targets specific individuals using personalized, researched content that bypasses generic spam filters. Email security gateways (SEGs) like Microsoft Defender for Office 365, Proofpoint,

detecting-sql-injection-via-waf-logs

mukul975/Anthropic-Cybersecurity-Skills

>-

detecting-stuxnet-style-attacks

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-supply-chain-attacks-in-ci-cd

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-suspicious-oauth-application-consent

mukul975/Anthropic-Cybersecurity-Skills

Detect risky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit logs, and permission analysis to identify illicit consent grant attacks.

detecting-suspicious-powershell-execution

mukul975/Anthropic-Cybersecurity-Skills

Detect suspicious PowerShell execution patterns including encoded commands, download cradles, AMSI bypass attempts, and constrained language mode evasion.

detecting-t1003-credential-dumping-with-edr

mukul975/Anthropic-Cybersecurity-Skills

Detect OS credential dumping techniques targeting LSASS memory, SAM database, NTDS.dit, and cached credentials using EDR telemetry, Sysmon process access monitoring, and Windows security event correlation.

detecting-t1055-process-injection-with-sysmon

mukul975/Anthropic-Cybersecurity-Skills

Detect process injection techniques (T1055) including classic DLL injection, process hollowing, and APC injection by analyzing Sysmon events for cross-process memory operations, remote thread creation, and anomalous DLL loading patterns.

detecting-t1548-abuse-elevation-control-mechanism

mukul975/Anthropic-Cybersecurity-Skills

Detect abuse of elevation control mechanisms including UAC bypass, sudo exploitation, and setuid/setgid manipulation by monitoring registry modifications, process elevation flags, and unusual parent-child process relationships.

detecting-typosquatting-packages-in-npm-pypi

mukul975/Anthropic-Cybersecurity-Skills

>

detecting-wmi-persistence

mukul975/Anthropic-Cybersecurity-Skills

Detect WMI event subscription persistence by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation.

detection-scoring

yogsoth-ai/de-anthropocentric-research-engine

Rate detectability 1-10 (inverted: 10 = hardest to detect). Estimates how likely current controls would catch the failure before impact.

detective

QinghongLin/data2story-skill

Research external context for a dataset — domain background, history, related studies, and why this data matters. Outputs detective.json (structured findings with det_xx IDs) before any analysis begins.

detox

partme-ai/full-stack-skills

"Provides comprehensive guidance for Detox mobile testing framework including React Native testing, E2E testing, and test synchronization. Use when the user asks about Detox, needs to test React Native applications, write E2E tests for mobile apps, or configure Detox."

detrack-automation

ComposioHQ/awesome-claude-skills

"Automate Detrack tasks via Rube MCP (Composio). Always search tools first for current schemas."

dev

stella/stella

Launch the local dev environment using the project''s dev-runner. The runner handles env symlinks, Docker services, port allocation, health checks, and browser opening automatically.

dev-browser

code-yeongyu/oh-my-openagent

Browser automation with persistent page state. Use when users ask to navigate websites, fill forms, take screenshots, extract web data, test web apps, or automate browser workflows. Trigger phrases include "go to [url]", "click on", "fill out the form", "take a screenshot", "scrape", "automate", "test the website", "log into", or any browser interaction request.

dev-commit

codeaholicguy/ai-devkit

AI DevKit · Safe git commit workflow for AI coding agents. Use when the user asks to commit, prepare a commit, stage changes, create a PR-ready checkpoint, or finish work with a conventional commit while avoiding unrelated user changes.

dev-container

antfu/dev-container

Configure, run and repair dev-container stacks, which are network-caged containers whose tokens are swapped in by an egress broker. Use when a project has a dev-container.config.*file, when a command prints DEV_CONTAINER_* diagnostics, or when an HTTP request inside a container fails with 403 and an `x-dev-container-diagnostic` header.

dev-design

codeaholicguy/ai-devkit

AI DevKit · Design phase guidance for reviewing feature design against requirements. Use when the user wants to validate architecture, review design docs, resolve design trade-offs, or run dev-lifecycle phase 3.

dev-env-setup

trailofbits/overtly-malicious-skills

Bootstraps standardized development environment configuration

dev-fix

HoangNguyen0403/agent-skills-standard

Unified developer workflow for fixing bugs. Analyzes issue-tracker context, cross-checks docs/code, proposes a solution, implements the fix, verifies locally, and delivers a PR/MR.

dev-implementation

codeaholicguy/ai-devkit

AI DevKit · Implementation phase guidance for executing feature plans and checking implementation against design. Use when the user wants to implement planned tasks, update implementation docs, verify code matches design, or run dev-lifecycle phases 5 and 7.

dev-lifecycle

codeaholicguy/ai-devkit

AI DevKit · Orchestrator for structured SDLC phase skills. Use when the user wants to run the full lifecycle or choose the next phase across requirements, design, planning, implementation, testing, and review.