[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skills:pro6":3,"skills:stats":50,"skills:sce6":55,"skills:creators9":100,"skills:all:stars:113:":195},[4,15,22,29,36,43],{"categoryNo":5,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":8,"categoryNameEn":9,"description":10,"level":11,"skillCount":12,"parentNo":13,"parentName":13,"children":14},"01JBSEEDCAT000000000000030","PROFESSION","适用职业","开发工程师","Software Engineer","从事软件编码、测试与运维的工程师",1,13274,null,[],{"categoryNo":16,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":17,"categoryNameEn":18,"description":19,"level":11,"skillCount":20,"parentNo":13,"parentName":13,"children":21},"01JBSEEDCAT000000000000032","设计师","Designer","视觉、交互与品牌设计人员",7775,[],{"categoryNo":23,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":24,"categoryNameEn":25,"description":26,"level":11,"skillCount":27,"parentNo":13,"parentName":13,"children":28},"01JBSEEDCAT000000000000033","数据分析师","Data Analyst","数据分析、报表与商业智能人员",4988,[],{"categoryNo":30,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":31,"categoryNameEn":32,"description":33,"level":11,"skillCount":34,"parentNo":13,"parentName":13,"children":35},"01JBSEEDCAT000000000000036","内容创作者","Content Creator","作者、编辑与自媒体创作者",3940,[],{"categoryNo":37,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":38,"categoryNameEn":39,"description":40,"level":11,"skillCount":41,"parentNo":13,"parentName":13,"children":42},"01JBSEEDCAT000000000000035","市场营销","Marketer","市场推广、增长与品牌运营人员",3446,[],{"categoryNo":44,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":45,"categoryNameEn":46,"description":47,"level":11,"skillCount":48,"parentNo":13,"parentName":13,"children":49},"01JBSEEDCAT000000000000037","律师与法务","Legal","合同、合规与法律事务人员",3316,[],{"skillCount":51,"professionCount":52,"scenarioCount":53,"creatorCount":54},196852,11,7,1926,[56,65,72,79,86,93],{"categoryNo":57,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":60,"categoryNameEn":61,"description":62,"level":11,"skillCount":63,"parentNo":13,"parentName":13,"children":64},"01JBSEEDCAT000000000000022","SCENARIO","使用场景","智能体与自动化","Agents & Automation","Skill、MCP、智能体与工作流自动化",39458,[],{"categoryNo":66,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":67,"categoryNameEn":68,"description":69,"level":11,"skillCount":70,"parentNo":13,"parentName":13,"children":71},"01JBSEEDCAT000000000000006","软件开发","Software Development","编码、测试、部署等软件研发任务",26531,[],{"categoryNo":73,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":74,"categoryNameEn":75,"description":76,"level":11,"skillCount":77,"parentNo":13,"parentName":13,"children":78},"01JBSEEDCAT000000000000014","设计创意","Design & Creative","视觉设计、品牌与多媒体创作",13569,[],{"categoryNo":80,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":81,"categoryNameEn":82,"description":83,"level":11,"skillCount":84,"parentNo":13,"parentName":13,"children":85},"01JBSEEDCAT000000000000001","办公效率","Office Productivity","日常办公文档、表格、演示与沟通类任务",6289,[],{"categoryNo":87,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":88,"categoryNameEn":89,"description":90,"level":11,"skillCount":91,"parentNo":13,"parentName":13,"children":92},"01JBSEEDCAT000000000000017","内容创作","Content Creation","写作、文案与营销内容生产",6029,[],{"categoryNo":94,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":95,"categoryNameEn":96,"description":97,"level":11,"skillCount":98,"parentNo":13,"parentName":13,"children":99},"01JBSEEDCAT000000000000020","研究与学习","Research & Learning","资料检索、知识整理与学习辅导",5531,[],{"records":101,"total":54,"current":11,"size":194},[102,114,123,133,143,153,163,172,182],{"accountNo":103,"login":104,"displayName":105,"avatarUrl":106,"accountType":107,"accountTypeDesc":108,"profileDescription":109,"skillCount":110,"repoCount":111,"professionCount":52,"scenarioCount":53,"totalStars":112,"updatedAt":113},"01M698VYDXZ6JW5WH3CRV650R8","microsoft","Microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","ORGANIZATION","组织","Open source projects and samples from Microsoft",4160,229,828772,"2026-11-13 04:10:52",{"accountNo":115,"login":116,"displayName":116,"avatarUrl":117,"accountType":107,"accountTypeDesc":108,"profileDescription":118,"skillCount":119,"repoCount":120,"professionCount":53,"scenarioCount":53,"totalStars":121,"updatedAt":122},"01M698P3FSAZ6B4R928ZF19KPT","openclaw","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F252820863?v=4","Your personal, open source AI assistant.",362,32,437711,"2026-11-13 03:02:05",{"accountNo":124,"login":125,"displayName":126,"avatarUrl":127,"accountType":107,"accountTypeDesc":108,"profileDescription":13,"skillCount":128,"repoCount":129,"professionCount":53,"scenarioCount":130,"totalStars":131,"updatedAt":132},"01M6AC29YGCR4S2NTJFV0G8B81","openai","OpenAI","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F14957082?v=4",171,23,6,342695,"2026-11-13 04:03:41",{"accountNo":134,"login":135,"displayName":136,"avatarUrl":137,"accountType":107,"accountTypeDesc":108,"profileDescription":13,"skillCount":138,"repoCount":139,"professionCount":140,"scenarioCount":53,"totalStars":141,"updatedAt":142},"01M6AC83E6K4FDKK7HZ8WNMQKE","apache","The Apache Software Foundation","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F47359?v=4",420,75,8,298176,"2026-11-13 03:14:28",{"accountNo":144,"login":145,"displayName":146,"avatarUrl":147,"accountType":107,"accountTypeDesc":108,"profileDescription":148,"skillCount":149,"repoCount":150,"professionCount":52,"scenarioCount":53,"totalStars":151,"updatedAt":152},"01M698VYEFDM0VJBZDYYJ2T83S","google","Google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","Google ❤️ Open Source",535,48,242366,"2026-11-13 04:17:09",{"accountNo":154,"login":155,"displayName":156,"avatarUrl":157,"accountType":107,"accountTypeDesc":108,"profileDescription":158,"skillCount":159,"repoCount":160,"professionCount":52,"scenarioCount":53,"totalStars":161,"updatedAt":162},"01M6AC83DS133TPXFSP1DHNCC6","github","GitHub","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9919?v=4","How people build software.",940,28,238441,"2026-11-13 03:57:35",{"accountNo":164,"login":165,"displayName":166,"avatarUrl":167,"accountType":107,"accountTypeDesc":108,"profileDescription":13,"skillCount":168,"repoCount":169,"professionCount":52,"scenarioCount":53,"totalStars":170,"updatedAt":171},"01M697XGDPXJAVQ8391V2BCYTE","anthropics","Anthropic","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F76263028?v=4",674,17,231826,"2026-11-13 04:18:26",{"accountNo":173,"login":174,"displayName":175,"avatarUrl":176,"accountType":107,"accountTypeDesc":108,"profileDescription":13,"skillCount":177,"repoCount":178,"professionCount":179,"scenarioCount":53,"totalStars":180,"updatedAt":181},"01M6AC83EPDGBFN19MWYRREJD0","Significant-Gravitas","AutoGPT","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F130738209?v=4",86,2,10,188014,"2026-11-13 02:38:59",{"accountNo":183,"login":184,"displayName":185,"avatarUrl":186,"accountType":187,"accountTypeDesc":188,"profileDescription":189,"skillCount":190,"repoCount":191,"professionCount":130,"scenarioCount":53,"totalStars":192,"updatedAt":193},"01M6DJCCDDG53MTYYRTXAXFG17","garrytan","Garry Tan","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F19957?v=4","USER","个人作者","Writes software, dreams. ",324,3,174614,"2026-11-13 04:05:07",9,{"records":196,"total":51,"current":564,"size":565},[197,234,261,283,298,321,340,370,386,405,430,443,460,479,492,514,534,548],{"skillNo":198,"name":199,"nameZh":13,"description":200,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":209,"categories":210,"keywords":214,"publishedAt":233},"01M6AEHD34W465QBJD76XZCJ6F","detecting-secure-boot-bypass","Detect UEFI Secure Boot bypasses and bootkits such as BlackLotus and Bootkitty by verifying Secure Boot state, checking dbx revocation currency, and hashing EFI boot binaries against known-bad sets using mokutil, efi-readvar\u002Fdbxtool, CHIPSEC, sbverify\u002Fpesign, and Windows Confirm-SecureBootUEFI. Use when auditing fleet dbx rollout after a bootkit advisory or hunting for pre-OS persistence on a suspected-compromised endpoint.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-secure-boot-bypass\u002FSKILL.md",[211],{"categoryNo":212,"categoryName":213,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000023","Skill与智能体开发",[215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232],"secure","boot","detecting secure boot bypass","security","cybersecurity","windows","state","persistence","bootkit","UEFI","firmware","Secure-Boot","chipsec","hardware-firmware-security","endpoint","dbx-revocation","blacklotus","firmware-integrity","2026-11-10 10:12:30",{"skillNo":235,"name":236,"nameZh":13,"description":237,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":238,"categories":239,"keywords":242,"publishedAt":233},"01M6AEH9NPSV5Z27WN5GQWAF46","detecting-s3-data-exfiltration-attempts","Detecting data exfiltration attempts from AWS S3 buckets by analyzing CloudTrail S3 data events, VPC Flow Logs, GuardDuty findings, Amazon Macie alerts, and S3 access patterns to identify unauthorized bulk downloads and cross-account data transfers.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-s3-data-exfiltration-attempts\u002FSKILL.md",[240,241],{"categoryNo":212,"categoryName":213,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":23,"categoryName":24,"taxonomyType":6,"taxonomyTypeDesc":7},[243,244,245,246,218,219,247,248,249,250,251,252,253,254,255,256,257,258,259,260],"s3","exfiltration","data","detecting s3 data exfiltration attempts","pr","logs","cloud","cloud-security","downloads","cloudtrail","threat-detection","data-exfiltration","analyzing","flow","aws","detection","guardduty","macie",{"skillNo":262,"name":263,"nameZh":13,"description":264,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":265,"categories":266,"keywords":268,"publishedAt":233},"01M6AEH65Q4AZN24WBFN1WD27K","detecting-rootkit-activity","Detects rootkit presence on compromised systems by identifying hidden processes, hooked system calls, modified kernel structures, and covert network connections using Volatility memory forensics, cross-view detection, and tools like GMER, rkhunter, chkrootkit, and RootkitRevealer. Use when standard tools (Task Manager, netstat, AV\u002FEDR) show nothing abnormal but compromise is suspected.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-rootkit-activity\u002FSKILL.md",[267],{"categoryNo":212,"categoryName":213,"taxonomyType":58,"taxonomyTypeDesc":59},[269,270,271,272,219,273,274,275,276,277,278,279,258,280,281,282],"rootkit","detecting rootkit activity","kernel","memory","forensics","malware","malware-analysis","memory-forensics","rkhunter","Volatility","network","edr","t1574","kernel-analysis",{"skillNo":284,"name":285,"nameZh":13,"description":286,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":287,"categories":288,"keywords":289,"publishedAt":233},"01M6AEH2N1QW0KKDBJY0CHXZD1","detecting-rdp-brute-force-attacks","Detect RDP brute force attacks by parsing Windows Security Event Logs (EVTX files, via python-evtx) for failed logon patterns (Event ID 4625, Logon Type 10\u002F3), correlating with successful logons (Event ID 4624), and analyzing NLA failures and source IP frequency. Use when investigating exposed RDP endpoints, building SIEM detection rules for credential guessing, or confirming whether a compromised account followed a brute-force pattern.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-rdp-brute-force-attacks\u002FSKILL.md",[],[290,291,218,219,292,220,248,253,255,293,258,294,295,296,297],"detecting rdp brute force attacks","python","siem","event-logs","brute-force","rdp","windows-event-logs","blue-team",{"skillNo":299,"name":300,"nameZh":13,"description":301,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":302,"categories":303,"keywords":305,"publishedAt":233},"01M6AEGYXG5J45S5PFM8Z0618J","detecting-ransomware-precursors-in-network","Detects early-stage ransomware indicators in network traffic before encryption begins, including initial access broker activity, command-and-control beaconing, credential harvesting, reconnaissance scanning, and staging behavior. Uses network detection tools (Zeek, Suricata, Arkime), SIEM correlation rules, and threat intelligence feeds to identify ransomware precursor patterns such as Cobalt Strike beacons, Mimikatz network signatures, and RDP brute-force attempts. Activates for requests involving pre-ransomware detection, network-based ransomware indicators, or early warning ransomware monitoring.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-ransomware-precursors-in-network\u002FSKILL.md",[304],{"categoryNo":212,"categoryName":213,"taxonomyType":58,"taxonomyTypeDesc":59},[279,306,307,218,219,292,308,247,309,310,311,312,313,314,315,316,317,318,319,320],"ransomware","detecting ransomware precursors in network","threat intelligence","development","monitoring","mimikatz","command-and-control","Zeek","network-security","encryption","cryptocurrency","feeds","suricata","defense","t1003",{"skillNo":322,"name":323,"nameZh":13,"description":324,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":325,"categories":326,"keywords":328,"publishedAt":233},"01M6AEGVPN8K8ZBTTYAK31S20C","detecting-ransomware-encryption-behavior","Detects ransomware encryption activity in real time using entropy analysis, file system I\u002FO monitoring (Sysmon, watchdog, psutil), and behavioral scoring to identify mass file modification, abnormal entropy spikes in written data, and suspicious process behavior characteristic of encryption routines. Use when building real-time ransomware detection, tuning entropy thresholds, or investigating suspected active encryption on an endpoint.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-ransomware-encryption-behavior\u002FSKILL.md",[327],{"categoryNo":212,"categoryName":213,"taxonomyType":58,"taxonomyTypeDesc":59},[306,315,329,330,331,332,219,247,333,310,334,245,316,335,258,336,319,337,338,339],"detecting ransomware encryption behavior","suspicious","real time","routines","file","behavioral-analysis","sysmon","watchdog","entropy","file-monitoring","heuristics",{"skillNo":341,"name":342,"nameZh":13,"description":343,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":344,"categories":345,"keywords":354,"publishedAt":233},"01M6AEGQXYRR48M7XH9ECVC0DT","detecting-qr-code-phishing-with-email-security","Detect and prevent QR code phishing (quishing) attacks that embed malicious URLs inside QR code images to bypass link-based email security, using image-based threat detection, OCR\u002FQR decoding, and mobile-side scanning (Microsoft Defender for O365, Proofpoint TAP, Barracuda Multimodal AI). Use when configuring gateway rules against QR phishing or investigating suspicious emails containing QR codes.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-qr-code-phishing-with-email-security\u002FSKILL.md",[346,349,352,353],{"categoryNo":347,"categoryName":348,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":350,"categoryName":351,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":212,"categoryName":213,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":5,"categoryName":8,"taxonomyType":6,"taxonomyTypeDesc":7},[218,355,356,357,358,359,360,330,219,361,247,362,363,364,365,366,367,319,368,369],"code","email","phishing","detecting qr code phishing with email security","image","malicious","defender","infrastructure","create","multimodal","website","gateway","image-analysis","qr-code","ocr",{"skillNo":371,"name":372,"nameZh":13,"description":373,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":374,"categories":375,"keywords":378,"publishedAt":233},"01M6AEGMV87W0RTMZWX57C1N8A","detecting-process-injection-techniques","Detects and analyzes process injection techniques used by malware including classic DLL injection, process hollowing, APC injection, thread hijacking, and reflective loading. Uses memory forensics, API monitoring, and behavioral analysis to identify injection artifacts. Activates for requests involving process injection detection, code injection analysis, hollowed process investigation, or in-memory threat detection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-process-injection-techniques\u002FSKILL.md",[376,377],{"categoryNo":212,"categoryName":213,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":5,"categoryName":8,"taxonomyType":6,"taxonomyTypeDesc":7},[379,272,219,355,380,381,382,383,333,310,273,274,275,276,384,258,319,385],"detecting process injection techniques","validation","artifacts","content","metadata","process-injection","defense-evasion",{"skillNo":387,"name":388,"nameZh":13,"description":389,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":390,"categories":391,"keywords":394,"publishedAt":233},"01M6AEGH8JS3G8FMPKM729VT3F","detecting-process-hollowing-technique","Detect process hollowing (MITRE T1055.012) by analyzing memory-mapped sections, hollowed process indicators, and parent-child anomalies using EDR telemetry, Volatility's malfind plugin, pe-sieve, Hollows Hunter, and Sysmon Event ID 25. Use when investigating a legitimate-looking process (svchost.exe, explorer.exe, rundll32.exe) suspected of hosting injected code via NtUnmapViewOfSection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-process-hollowing-technique\u002FSKILL.md",[392,393],{"categoryNo":212,"categoryName":213,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":5,"categoryName":8,"taxonomyType":6,"taxonomyTypeDesc":7},[395,272,219,396,397,355,398,310,399,400,278,255,335,401,402,384,258,280,403,404],"detecting process hollowing technique","telemetry","plugin","verification","mitre-attack","threat-hunting","hardening","proactive-detection","process-hollowing","t1055",{"skillNo":406,"name":407,"nameZh":13,"description":408,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":409,"categories":410,"keywords":414,"publishedAt":233},"01M6AEGDG9VHDKPPGKY9Y79WX9","detecting-privilege-escalation-in-kubernetes-pods","Detects and prevents privilege escalation inside Kubernetes pods by combining admission control (OPA policies), runtime monitoring (Falco), and audit log analysis of security contexts, Linux capabilities, and syscall patterns. Use when investigating a pod running as root or privileged, hardening workloads against in-pod escalation, or hunting for containers exceeding their intended scope. Keywords: allowPrivilegeEscalation, runAsRoot, capabilities, securityContext, OPA, Falco, audit log. Do not use for escalation through RBAC and service-account permissions - use auditing-kubernetes-rbac-privilege-escalation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-privilege-escalation-in-kubernetes-pods\u002FSKILL.md",[411],{"categoryNo":412,"categoryName":413,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000011","运维与部署",[415,416,417,418,419,218,219,420,247,421,422,423,424,333,425,310,426,427,428,429],"kubernetes","escalation","detecting privilege escalation in kubernetes pods","containers","linux","rbac","opa","authentication","capabilities","permissions","audit","privilege-escalation","container-security","service-account","falco",{"skillNo":431,"name":432,"nameZh":13,"description":433,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":434,"categories":435,"keywords":437,"publishedAt":233},"01M6AEG9RNN4D2GD4046SZHBVP","detecting-privilege-escalation-attempts","Detect privilege escalation attempts across Windows and Linux, including access token manipulation, UAC bypass, unquoted service path abuse, kernel exploits, and sudo\u002Fdoas abuse. Use when threat hunting for T1068-style privilege escalation, triaging EDR\u002FSIEM alerts on suspicious privilege changes, scoping compromise during incident response, or validating detection coverage in a purple team exercise.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-privilege-escalation-attempts\u002FSKILL.md",[436],{"categoryNo":212,"categoryName":213,"taxonomyType":58,"taxonomyTypeDesc":59},[416,438,330,271,419,219,439,292,440,220,426,399,400,441,402,258,280,442],"detecting privilege escalation attempts","incident response","threat hunting","token-manipulation","uac-bypass",{"skillNo":444,"name":445,"nameZh":13,"description":446,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":447,"categories":448,"keywords":450,"publishedAt":233},"01M6AEG68QGTXJ5YZN3E5NY1B5","detecting-port-scanning-with-fail2ban","Configures Fail2ban with custom filters and actions to detect port scanning activity, SSH brute force attempts, and network reconnaissance, automatically banning offending IP addresses and alerting security teams to suspicious network probing.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-port-scanning-with-fail2ban\u002FSKILL.md",[449],{"categoryNo":212,"categoryName":213,"taxonomyType":58,"taxonomyTypeDesc":59},[451,330,218,219,247,452,453,454,279,314,455,319,456,457,458,459],"detecting port scanning with fail2ban","teams","alerting","actions","reconnaissance","port-scanning","fail2ban","intrusion-prevention","automated-defense",{"skillNo":461,"name":462,"nameZh":13,"description":463,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":464,"categories":465,"keywords":466,"publishedAt":233},"01M6AEG2H27FQ4EYH80BFJ6TGT","detecting-pass-the-ticket-attacks","Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns, with detection queries for Splunk and Elastic SIEM. Use when investigating incidents involving stolen or replayed Kerberos tickets, building detection rules or threat hunting queries for ticket abuse, or validating SOC monitoring coverage for credential-theft attack techniques.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-pass-the-ticket-attacks\u002FSKILL.md",[],[467,468,219,292,440,220,469,310,470,471,472,253,255,473,474,475,476,477,258,478],"detecting pass the ticket attacks","directory","protocol","active-directory","soc","splunk","elastic","kerberos","pass-the-ticket","ids","windows-security","credential-theft",{"skillNo":480,"name":481,"nameZh":13,"description":482,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":483,"categories":484,"keywords":486,"publishedAt":233},"01M6AEFYSREZSP2S3H0PFF6G5K","detecting-pass-the-hash-attacks","Detect Pass-the-Hash (T1550.002) attacks by analyzing NTLM authentication patterns, flagging Type 3 logons using NTLM where Kerberos would be expected, and correlating with credential-dumping indicators. Use when threat hunting for lateral movement via stolen NTLM hashes, triaging EDR\u002FSIEM alerts on suspicious NTLM logons, scoping compromise during incident response, or validating detection coverage in a purple team exercise.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-pass-the-hash-attacks\u002FSKILL.md",[485],{"categoryNo":212,"categoryName":213,"taxonomyType":58,"taxonomyTypeDesc":59},[487,330,219,439,292,440,422,469,488,399,400,255,402,489,474,258,280,490,320,491],"detecting pass the hash attacks","credential-access","credential-dumping","pass-the-hash","t1550",{"skillNo":493,"name":494,"nameZh":13,"description":495,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":496,"categories":497,"keywords":499,"publishedAt":233},"01M6AEFVHE1XEE3WGJA66X617P","detecting-oauth-token-theft","Detect and respond to OAuth token theft and replay in Microsoft Entra ID (Azure AD), covering access token theft, refresh token replay, Primary Refresh Token (PRT) abuse, pass-the-cookie attacks, and Token Protection conditional access policies. Use for impossible-travel or anomalous token-usage alerts, suspected session hijacking, sign-in log analysis, or configuring token-binding defenses in Azure\u002FM365.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-oauth-token-theft\u002FSKILL.md",[498],{"categoryNo":212,"categoryName":213,"taxonomyType":58,"taxonomyTypeDesc":59},[500,501,218,219,502,104,503,504,505,247,422,506,250,507,508,509,510,511,512,513],"OAuth","detecting oauth token theft","web","identity","entra id","azure","browser","entra-id","azure-ad","token-theft","impossible-travel","token-replay","identity-security","PRT",{"skillNo":515,"name":516,"nameZh":13,"description":517,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":518,"categories":519,"keywords":521,"publishedAt":233},"01M6AEFQ7HAHXWXMM96E6EC6HG","detecting-ntlm-relay-with-event-correlation","Detect NTLM relay attacks (T1557.001) by correlating Windows Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder\u002FLLMNR poisoning artifacts, auditing SMB\u002FLDAP signing, and flagging NTLMv2-to-NTLMv1 downgrades. Use for hunting credential relay in NTLM-enabled AD, investigating auth-source anomalies, building SIEM correlation rules, or responding to PetitPotam\u002FDFSCoerce\u002FPrinterBug alerts.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-ntlm-relay-with-event-correlation\u002FSKILL.md",[520],{"categoryNo":212,"categoryName":213,"taxonomyType":58,"taxonomyTypeDesc":59},[522,523,468,219,292,524,220,381,525,470,400,279,526,527,528,529,530,531,532,533],"correlation","detecting ntlm relay with event correlation","auth","server","petitpotam","ntlm-relay","Responder","smb","event-correlation","T1557.001","Event-4624","SMB-signing",{"skillNo":535,"name":536,"nameZh":13,"description":537,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":538,"categories":539,"keywords":541,"publishedAt":233},"01M6AEFK0N7JCKJ528C6QPB5MM","detecting-network-scanning-with-ids-signatures","Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures, threshold-based detection rules, and traffic anomaly analysis to identify Nmap, Masscan, and custom scanning activity.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-network-scanning-with-ids-signatures\u002FSKILL.md",[540],{"categoryNo":212,"categoryName":213,"taxonomyType":58,"taxonomyTypeDesc":59},[279,476,542,218,219,247,314,455,543,544,318,258,545,456,546,547],"detecting network scanning with ids signatures","Nmap","snort","nmap-detection","signature-detection","threshold-rules",{"skillNo":549,"name":550,"nameZh":13,"description":551,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":552,"categories":553,"keywords":556,"publishedAt":233},"01M6AEFFQXV2Y8ATDBHDY776XR","detecting-network-anomalies-with-zeek","Deploy and configure Zeek (formerly Bro) to passively analyze network traffic, generate structured connection\u002FDNS\u002FHTTP\u002FSSL\u002Ffile logs, detect anomalous behavior, and write custom scripts for organization-specific threats. Use for passive monitoring at network choke points, feeding SIEM\u002Fthreat hunting with protocol metadata, or retrospective log analysis during incident response; not a substitute for inline IDS\u002FIPS or host agents.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-network-anomalies-with-zeek\u002FSKILL.md",[554,555],{"categoryNo":412,"categoryName":413,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":212,"categoryName":213,"taxonomyType":58,"taxonomyTypeDesc":59},[279,313,557,218,219,439,292,440,558,247,559,248,310,400,560,561,314,476,562,563],"detecting network anomalies with zeek","http","generate","ssl","dns","ips","network-monitoring",113,18]