[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skills:pro6":3,"skills:sce6":50,"skills:creators9":95,"skills:stats":193,"skills:all:stars:107:":195},[4,15,22,29,36,43],{"categoryNo":5,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":8,"categoryNameEn":9,"description":10,"level":11,"skillCount":12,"parentNo":13,"parentName":13,"children":14},"01JBSEEDCAT000000000000030","PROFESSION","适用职业","开发工程师","Software Engineer","从事软件编码、测试与运维的工程师",1,13274,null,[],{"categoryNo":16,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":17,"categoryNameEn":18,"description":19,"level":11,"skillCount":20,"parentNo":13,"parentName":13,"children":21},"01JBSEEDCAT000000000000032","设计师","Designer","视觉、交互与品牌设计人员",7775,[],{"categoryNo":23,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":24,"categoryNameEn":25,"description":26,"level":11,"skillCount":27,"parentNo":13,"parentName":13,"children":28},"01JBSEEDCAT000000000000033","数据分析师","Data Analyst","数据分析、报表与商业智能人员",4988,[],{"categoryNo":30,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":31,"categoryNameEn":32,"description":33,"level":11,"skillCount":34,"parentNo":13,"parentName":13,"children":35},"01JBSEEDCAT000000000000036","内容创作者","Content Creator","作者、编辑与自媒体创作者",3940,[],{"categoryNo":37,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":38,"categoryNameEn":39,"description":40,"level":11,"skillCount":41,"parentNo":13,"parentName":13,"children":42},"01JBSEEDCAT000000000000035","市场营销","Marketer","市场推广、增长与品牌运营人员",3446,[],{"categoryNo":44,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":45,"categoryNameEn":46,"description":47,"level":11,"skillCount":48,"parentNo":13,"parentName":13,"children":49},"01JBSEEDCAT000000000000037","律师与法务","Legal","合同、合规与法律事务人员",3316,[],[51,60,67,74,81,88],{"categoryNo":52,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":55,"categoryNameEn":56,"description":57,"level":11,"skillCount":58,"parentNo":13,"parentName":13,"children":59},"01JBSEEDCAT000000000000022","SCENARIO","使用场景","智能体与自动化","Agents & Automation","Skill、MCP、智能体与工作流自动化",39458,[],{"categoryNo":61,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":62,"categoryNameEn":63,"description":64,"level":11,"skillCount":65,"parentNo":13,"parentName":13,"children":66},"01JBSEEDCAT000000000000006","软件开发","Software Development","编码、测试、部署等软件研发任务",26531,[],{"categoryNo":68,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":69,"categoryNameEn":70,"description":71,"level":11,"skillCount":72,"parentNo":13,"parentName":13,"children":73},"01JBSEEDCAT000000000000014","设计创意","Design & Creative","视觉设计、品牌与多媒体创作",13569,[],{"categoryNo":75,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":76,"categoryNameEn":77,"description":78,"level":11,"skillCount":79,"parentNo":13,"parentName":13,"children":80},"01JBSEEDCAT000000000000001","办公效率","Office Productivity","日常办公文档、表格、演示与沟通类任务",6289,[],{"categoryNo":82,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":83,"categoryNameEn":84,"description":85,"level":11,"skillCount":86,"parentNo":13,"parentName":13,"children":87},"01JBSEEDCAT000000000000017","内容创作","Content Creation","写作、文案与营销内容生产",6029,[],{"categoryNo":89,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":90,"categoryNameEn":91,"description":92,"level":11,"skillCount":93,"parentNo":13,"parentName":13,"children":94},"01JBSEEDCAT000000000000020","研究与学习","Research & Learning","资料检索、知识整理与学习辅导",5531,[],{"records":96,"total":191,"current":11,"size":192},[97,111,120,130,140,150,160,169,179],{"accountNo":98,"login":99,"displayName":100,"avatarUrl":101,"accountType":102,"accountTypeDesc":103,"profileDescription":104,"skillCount":105,"repoCount":106,"professionCount":107,"scenarioCount":108,"totalStars":109,"updatedAt":110},"01M698VYDXZ6JW5WH3CRV650R8","microsoft","Microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","ORGANIZATION","组织","Open source projects and samples from Microsoft",4160,229,11,7,828772,"2026-11-13 04:10:52",{"accountNo":112,"login":113,"displayName":113,"avatarUrl":114,"accountType":102,"accountTypeDesc":103,"profileDescription":115,"skillCount":116,"repoCount":117,"professionCount":108,"scenarioCount":108,"totalStars":118,"updatedAt":119},"01M698P3FSAZ6B4R928ZF19KPT","openclaw","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F252820863?v=4","Your personal, open source AI assistant.",362,32,437711,"2026-11-13 03:02:05",{"accountNo":121,"login":122,"displayName":123,"avatarUrl":124,"accountType":102,"accountTypeDesc":103,"profileDescription":13,"skillCount":125,"repoCount":126,"professionCount":108,"scenarioCount":127,"totalStars":128,"updatedAt":129},"01M6AC29YGCR4S2NTJFV0G8B81","openai","OpenAI","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F14957082?v=4",171,23,6,342695,"2026-11-13 04:03:41",{"accountNo":131,"login":132,"displayName":133,"avatarUrl":134,"accountType":102,"accountTypeDesc":103,"profileDescription":13,"skillCount":135,"repoCount":136,"professionCount":137,"scenarioCount":108,"totalStars":138,"updatedAt":139},"01M6AC83E6K4FDKK7HZ8WNMQKE","apache","The Apache Software Foundation","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F47359?v=4",420,75,8,298176,"2026-11-13 03:14:28",{"accountNo":141,"login":142,"displayName":143,"avatarUrl":144,"accountType":102,"accountTypeDesc":103,"profileDescription":145,"skillCount":146,"repoCount":147,"professionCount":107,"scenarioCount":108,"totalStars":148,"updatedAt":149},"01M698VYEFDM0VJBZDYYJ2T83S","google","Google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","Google ❤️ Open Source",535,48,242366,"2026-11-13 04:17:09",{"accountNo":151,"login":152,"displayName":153,"avatarUrl":154,"accountType":102,"accountTypeDesc":103,"profileDescription":155,"skillCount":156,"repoCount":157,"professionCount":107,"scenarioCount":108,"totalStars":158,"updatedAt":159},"01M6AC83DS133TPXFSP1DHNCC6","github","GitHub","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9919?v=4","How people build software.",940,28,238441,"2026-11-13 03:57:35",{"accountNo":161,"login":162,"displayName":163,"avatarUrl":164,"accountType":102,"accountTypeDesc":103,"profileDescription":13,"skillCount":165,"repoCount":166,"professionCount":107,"scenarioCount":108,"totalStars":167,"updatedAt":168},"01M697XGDPXJAVQ8391V2BCYTE","anthropics","Anthropic","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F76263028?v=4",674,17,231826,"2026-11-13 04:18:26",{"accountNo":170,"login":171,"displayName":172,"avatarUrl":173,"accountType":102,"accountTypeDesc":103,"profileDescription":13,"skillCount":174,"repoCount":175,"professionCount":176,"scenarioCount":108,"totalStars":177,"updatedAt":178},"01M6AC83EPDGBFN19MWYRREJD0","Significant-Gravitas","AutoGPT","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F130738209?v=4",86,2,10,188014,"2026-11-13 02:38:59",{"accountNo":180,"login":181,"displayName":182,"avatarUrl":183,"accountType":184,"accountTypeDesc":185,"profileDescription":186,"skillCount":187,"repoCount":188,"professionCount":127,"scenarioCount":108,"totalStars":189,"updatedAt":190},"01M6DJCCDDG53MTYYRTXAXFG17","garrytan","Garry Tan","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F19957?v=4","USER","个人作者","Writes software, dreams. ",324,3,174614,"2026-11-13 04:05:07",1926,9,{"skillCount":194,"professionCount":107,"scenarioCount":108,"creatorCount":191},196852,{"records":196,"total":194,"current":498,"size":499},[197,236,259,277,294,312,334,349,359,374,386,400,416,426,443,458,468,488],{"skillNo":198,"name":199,"nameZh":13,"description":200,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":209,"categories":210,"keywords":214,"publishedAt":235},"01M6AEXKQK6DC80QKA5WFG0Q2B","hunting-for-unusual-network-connections","Runs a hypothesis-driven threat hunt for command-and-control activity (T1071) by querying SIEM\u002FEDR network telemetry for anomalous outbound traffic, rare destinations, non-standard ports, and unusual connection frequencies from endpoints. Use when hunting for beaconing\u002FC2 traffic, after threat intel flags suspicious infrastructure, or when alerts fire on anomalous connections.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-unusual-network-connections\u002FSKILL.md",[211],{"categoryNo":212,"categoryName":213,"taxonomyType":53,"taxonomyTypeDesc":54},"01JBSEEDCAT000000000000023","Skill与智能体开发",[215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234],"network","hunting for unusual network connections","suspicious","cybersecurity","siem","telemetry","validation","protocol","file","mitre-attack","threat-hunting","c2","command-and-control","network-analysis","hypothesis","proactive-detection","detection","edr","anomaly-detection","beaconing","2026-11-10 10:12:30",{"skillNo":237,"name":238,"nameZh":13,"description":239,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":240,"categories":241,"keywords":242,"publishedAt":235},"01M6AEXG7KME1EHF6K0E672F41","hunting-for-t1098-account-manipulation","Hunts for MITRE ATT&CK T1098 account manipulation - shadow admin creation, SID history injection, group membership changes, and credential modifications - by analyzing Windows Security Event Log IDs 4738, 4728, 4732, 4756, 4670, and 5136. Use when investigating suspected privilege persistence in Active Directory, after detecting anomalous group\u002Fcredential changes, or during incident response to trace account tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-t1098-account-manipulation\u002FSKILL.md",[],[243,244,245,218,246,247,248,222,249,250,251,224,225,252,253,254,255,256,257,258],"hunting for t1098 account manipulation","directory","security","incident response","windows","authentication","admin","persistence","active-directory","analyzing","ids","ATT&CK","t1003","injection","t1098","account-manipulation",{"skillNo":260,"name":261,"nameZh":13,"description":262,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":263,"categories":264,"keywords":266,"publishedAt":235},"01M6AEXD1X93P6RJ3T18SWVXE5","hunting-for-suspicious-scheduled-tasks","Hunts for adversary persistence and execution via Windows scheduled tasks (T1053.005) by analyzing Security Event ID 4698 task-creation events, suspicious task properties, and unusual execution patterns from schtasks.exe\u002Fat.exe. Use after detecting schtasks or at.exe in process creation logs, during incident response to enumerate persistence on compromised hosts, or when Event ID 4698 fires for an unusual task.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-suspicious-scheduled-tasks\u002FSKILL.md",[265],{"categoryNo":212,"categoryName":213,"taxonomyType":53,"taxonomyTypeDesc":54},[217,267,268,245,218,246,247,250,269,225,252,270,231,271,272,273,274,275,276],"tasks","hunting for suspicious scheduled tasks","logs","endpoint","endpoint-detection","scheduled-tasks","execution","t1547","t1053","mitre-t1053-005",{"skillNo":278,"name":279,"nameZh":13,"description":280,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":281,"categories":282,"keywords":284,"publishedAt":235},"01M6AEX9SNK5TZJ1KE672P55Y6","hunting-for-supply-chain-compromise","Runs a hypothesis-driven threat hunt for supply-chain compromise (T1195) by querying SIEM\u002FEDR logs for trojanized software updates, compromised dependencies, unauthorized code modifications, and tampered build artifacts. Use when hunting after threat intel flags a compromised vendor\u002Fdependency, scoping a build-pipeline compromise, or reviewing update\u002Fbuild integrity.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-supply-chain-compromise\u002FSKILL.md",[283],{"categoryNo":212,"categoryName":213,"taxonomyType":53,"taxonomyTypeDesc":54},[285,218,219,286,287,288,269,224,225,289,290,291,229,230,231,232,292,293],"hunting for supply chain compromise","update","code","artifacts","supply-chain","hardening","pipeline","initial-access","t1195",{"skillNo":295,"name":296,"nameZh":13,"description":297,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":298,"categories":299,"keywords":300,"publishedAt":235},"01M6AEX6MSAG9HH3JM6XRWHHFG","hunting-for-startup-folder-persistence","Detects T1547.001 startup folder persistence by monitoring Windows startup directories for suspicious file creation, cross-referencing Autoruns entries, and running a Python watchdog script for real-time filesystem monitoring. Use when hunting for malware or implants that survive reboot via startup-folder placement, or when validating autoruns\u002FEDR findings against known-good startup baselines.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-startup-folder-persistence\u002FSKILL.md",[],[250,301,302,217,303,218,247,221,223,304,225,305,306,232,307,273,308,309,310,311],"startup","hunting for startup folder persistence","python","monitoring","malware","autoruns","watchdog","real-time","T1547.001","startup-folder","filesystem-monitoring",{"skillNo":313,"name":314,"nameZh":13,"description":315,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":316,"categories":317,"keywords":322,"publishedAt":235},"01M6AEX2YHRMZ66HHR7S3HNEDG","hunting-for-spearphishing-indicators","Hunt for spearphishing campaign indicators across email logs, endpoint telemetry, and network data to detect targeted email attacks.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-spearphishing-indicators\u002FSKILL.md",[318,321],{"categoryNo":319,"categoryName":320,"taxonomyType":53,"taxonomyTypeDesc":54},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":212,"categoryName":213,"taxonomyType":53,"taxonomyTypeDesc":54},[323,324,325,245,218,220,326,327,328,329,269,330,224,225,331,215,332,270,292,333],"spearphishing","indicators","hunting for spearphishing indicators","development","create","search","website","email","email-security","data","t1566",{"skillNo":335,"name":336,"nameZh":13,"description":337,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":338,"categories":339,"keywords":341,"publishedAt":235},"01M6AEWZFDFPFY316B5QQFAZFV","hunting-for-shadow-copy-deletion","Runs a hypothesis-driven threat hunt for Volume Shadow Copy deletion (T1490) by querying SIEM\u002FEDR telemetry for vssadmin, wmic shadowcopy, and PowerShell shadow-copy-deletion commands. Use when hunting for ransomware preparation or anti-forensics activity, after threat intel flags active campaigns, or when alerts trigger on shadow-copy deletion commands.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-shadow-copy-deletion\u002FSKILL.md",[340],{"categoryNo":212,"categoryName":213,"taxonomyType":53,"taxonomyTypeDesc":54},[342,218,219,220,286,343,224,225,344,345,290,229,230,231,232,346,347,348],"hunting for shadow copy deletion","forensics","powershell","ransomware","shadow-copy","anti-forensics","t1490",{"skillNo":350,"name":351,"nameZh":13,"description":352,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":353,"categories":354,"keywords":356,"publishedAt":235},"01M6AEWVZ1FQ3NQGYNRFSFSXQP","hunting-for-scheduled-task-persistence","Runs a hypothesis-driven threat hunt for Windows Scheduled Task persistence (T1053), guiding SIEM\u002FEDR queries against task creation events (e.g. Event ID 4698), suspicious task actions, and unusual scheduling patterns. Use when hunting for scheduled-task persistence, after threat intel flags related campaigns, during incident response, or when alerts fire on schtasks\u002Fat.exe activity.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-scheduled-task-persistence\u002FSKILL.md",[355],{"categoryNo":212,"categoryName":213,"taxonomyType":53,"taxonomyTypeDesc":54},[250,357,217,218,246,219,247,267,304,358,224,225,229,230,231,232,272,273,274,275],"hunting for scheduled task persistence","actions",{"skillNo":360,"name":361,"nameZh":13,"description":362,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":363,"categories":364,"keywords":365,"publishedAt":235},"01M6AEWS09VCJR7G1301WVZ4W6","hunting-for-registry-run-key-persistence","Detect MITRE ATT&CK T1547.001 registry Run key persistence by analyzing Sysmon Event ID 13 logs and registry queries to identify malicious auto-start entries.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-registry-run-key-persistence\u002FSKILL.md",[],[366,367,250,368,369,218,247,221,223,269,370,343,224,225,371,252,372,254,273,373],"run","registry","hunting for registry run key persistence","malicious","start","windows-forensics","sysmon","registry-run-keys",{"skillNo":375,"name":376,"nameZh":13,"description":377,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":378,"categories":379,"keywords":381,"publishedAt":235},"01M6AEWNFQ56K2HW15P0662JH2","hunting-for-registry-persistence-mechanisms","Hunts for registry-based persistence mechanisms (MITRE T1547) in Windows environments, including Run\u002FRunOnce keys, Winlogon Shell\u002FUserinit modifications, Image File Execution Options (IFEO) debugger injection, and COM hijacking via CLSID overrides. Use when auditing the registry for persistence artifacts or building detections for registry-based malware autostart techniques.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-registry-persistence-mechanisms\u002FSKILL.md",[380],{"categoryNo":212,"categoryName":213,"taxonomyType":53,"taxonomyTypeDesc":54},[367,250,382,383,218,247,366,221,288,384,385,223,224,225,305,230,231,273,256,274],"hunting for registry persistence mechanisms","image","content","metadata",{"skillNo":387,"name":388,"nameZh":13,"description":389,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":390,"categories":391,"keywords":392,"publishedAt":235},"01M6AEWJ9KC1ZN5H4MW8S6S5QQ","hunting-for-process-injection-techniques","Detects process injection techniques (MITRE T1055) — including CreateRemoteThread injection, process hollowing, and DLL injection — by analyzing Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess) alongside EDR process telemetry. Use when hunting for in-memory code injection or defense evasion via legitimate process abuse on Windows endpoints.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-process-injection-techniques\u002FSKILL.md",[],[256,393,394,218,247,220,287,221,223,225,252,372,395,253,232,396,397,273,398,399],"hunting for process injection techniques","memory","process-injection","defense","t1055","dll-injection","createremotethread",{"skillNo":401,"name":402,"nameZh":13,"description":403,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":404,"categories":405,"keywords":407,"publishedAt":235},"01M6AEWEC1QJ25VYBASMGMZY97","hunting-for-persistence-via-wmi-subscriptions","Hunts for adversary persistence via WMI event subscriptions (MITRE T1546.003) by monitoring the creation of WMI event filters, consumers, and filter-to-consumer bindings that trigger malicious code execution on system events. Use when investigating fileless, trigger-based persistence on Windows hosts or auditing WMI repository contents for malicious event subscriptions.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-persistence-via-wmi-subscriptions\u002FSKILL.md",[406],{"categoryNo":212,"categoryName":213,"taxonomyType":53,"taxonomyTypeDesc":54},[250,408,409,369,218,247,287,222,304,410,411,225,215,270,271,273,412,413,414,415],"wmi","hunting for persistence via wmi subscriptions","server","repository","t1546.003","wmi-persistence","mitre-t1546-003","event-subscription",{"skillNo":417,"name":418,"nameZh":13,"description":419,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":420,"categories":421,"keywords":423,"publishedAt":235},"01M6AEWATK5A7BRJT2CDQ60303","hunting-for-persistence-mechanisms-in-windows","Systematically hunts for adversary persistence mechanisms across Windows endpoints, covering registry Run\u002FRunOnce keys, services, startup folders, scheduled tasks, and WMI event subscriptions. Use when performing a broad persistence sweep during incident response or building SIEM detections that cover the full range of Windows persistence techniques (MITRE T1547).","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-persistence-mechanisms-in-windows\u002FSKILL.md",[422],{"categoryNo":212,"categoryName":213,"taxonomyType":53,"taxonomyTypeDesc":54},[247,250,424,218,246,219,267,366,367,221,384,223,425,224,225,301,230,231,273,408],"hunting for persistence mechanisms in windows","services",{"skillNo":427,"name":428,"nameZh":13,"description":429,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":430,"categories":431,"keywords":432,"publishedAt":235},"01M6AEW7HJDPBDNNRVKPNBZQ7R","hunting-for-ntlm-relay-attacks","Detects NTLM relay attacks (MITRE T1557.001) by analyzing Windows Event ID 4624 logon type 3 with NTLMSSP authentication, flagging IP-to-hostname mismatches, Responder\u002FLLMNR poisoning signatures, SMB signing status, and anomalous cross-domain authentication patterns. Use when investigating credential-relay activity in Active Directory or building detections for NTLM relay and coercion-based attacks.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-ntlm-relay-attacks\u002FSKILL.md",[],[433,244,218,434,247,248,222,410,435,251,225,252,215,436,437,438,439,440,441,442],"hunting for ntlm relay attacks","status","credential-access","windows-events","Responder","smb","T1557.001","Event-4624","SMB-signing","NTLMSSP",{"skillNo":444,"name":445,"nameZh":13,"description":446,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":447,"categories":448,"keywords":450,"publishedAt":235},"01M6AEW3ZS1H4CZ1YRZZZ6940F","hunting-for-lolbins-execution-in-endpoint-logs","Hunts for LOLBins (Living Off the Land Binaries) abuse, mapped to MITRE T1218, by analyzing endpoint process-creation logs for suspicious execution patterns of legitimate Windows system binaries used for malicious purposes. Use when reviewing endpoint process telemetry for LOLBins-based defense evasion or building detections for signed-binary proxy execution.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-lolbins-execution-in-endpoint-logs\u002FSKILL.md",[449],{"categoryNo":212,"categoryName":213,"taxonomyType":53,"taxonomyTypeDesc":54},[269,270,451,273,452,369,217,218,247,220,453,454,304,225,252,396,455,456,271,457],"LOLBins","hunting for lolbins execution in endpoint logs","land","proxy","defense-evasion","process-monitoring","process-creation",{"skillNo":459,"name":460,"nameZh":13,"description":461,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":462,"categories":463,"keywords":465,"publishedAt":235},"01M6AEW0KFASYECBVKCPTTCZBA","hunting-for-living-off-the-land-binaries","Proactively hunts for adversary abuse of legitimate, signed system binaries (LOLBins) used to execute malicious payloads, download files, or proxy execution while evading application allowlisting and defense-evasion controls. Use when building LOLBins detection rules for EDR\u002FSIEM or when threat hunting for defense-evasion activity involving trusted system binaries.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-living-off-the-land-binaries\u002FSKILL.md",[464],{"categoryNo":212,"categoryName":213,"taxonomyType":53,"taxonomyTypeDesc":54},[453,466,369,218,219,467,221,222,384,454,223,224,225,230,231,232,396,455,451,273],"hunting for living off the land binaries","threat hunting",{"skillNo":469,"name":470,"nameZh":13,"description":471,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":472,"categories":473,"keywords":478,"publishedAt":235},"01M6AEVWZK5FEPD1FJPAZS2C6Z","hunting-for-living-off-the-cloud-techniques","Hunts for adversary abuse of legitimate cloud services (Azure, AWS, GCP, and SaaS platforms) for command-and-control, data staging, and exfiltration, i.e. \"living off the cloud\" tradecraft that blends in with normal cloud API and service activity. Use when threat hunting for cloud-native C2 channels, abnormal use of storage\u002FSaaS services for data staging, or exfiltration hidden in legitimate cloud traffic.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-living-off-the-cloud-techniques\u002FSKILL.md",[474,477],{"categoryNo":475,"categoryName":476,"taxonomyType":53,"taxonomyTypeDesc":54},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":212,"categoryName":213,"taxonomyType":53,"taxonomyTypeDesc":54},[479,480,218,467,481,482,222,410,425,224,225,226,227,483,215,484,231,485,486,487],"cloud","hunting for living off the cloud techniques","storage","azure","exfiltration","gcp","cloud-abuse","lotc","saas",{"skillNo":489,"name":490,"nameZh":13,"description":491,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":492,"categories":493,"keywords":494,"publishedAt":235},"01M6AEVSZ47C0RAPP79F5XDFNQ","hunting-for-lateral-movement-via-wmi","Detects WMI-based lateral movement (e.g. wmic process call create, Win32_Process.Create()) by analyzing Windows Event ID 4688 and Sysmon Event ID 1 for WmiPrvSE.exe spawning suspicious child processes like cmd.exe or powershell.exe, plus WMI-Activity\u002FOperational events 5857\u002F5860\u002F5861 for subscription-based persistence. Use when hunting for remote code execution via WMI or investigating lateral movement across Windows hosts.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-lateral-movement-via-wmi\u002FSKILL.md",[],[408,495,217,218,247,327,287,496,250,224,225,252,344,372,497,273,457],"hunting for lateral movement via wmi","win32","lateral-movement",107,18]