GPTsApp SkillsCodex Reset
Menu
Codex Reset

Find a skill for the job.

Compare the method, check the prerequisites, then go to the exact source.

Refine by task, source or prerequisites

Technology mentions are not dependencies. Client filters require scoped documentation, not a runtime compatibility claim. Detailed guides summarize files read at a fixed commit; they are not runtime tests.

8364 matches

Pinned source methods · Setup may be unknown
Choose 2–3 sharing a task.Selection guidance uses this directory’s task labels only. It is not runtime compatibility.

  1. hunting-for-data-staging-before-exfiltration

    skill collectionNo comparison task assigned

    byhartvig/agent-skills-collectiondevelopment-and-testing/cybersecurity-skills/hunting-for-data-staging-before-exfiltration/SKILL.md

    Detect data staging activity before exfiltration by monitoring for archive (SKILL.md metadata excerpt)

    Setup not establishedSource observation · Source example · File structure observedRead SKILL.md ↗Study method & source

  2. hunting-for-data-staging-before-exfiltration

    skill collectionNo comparison task assigned

    mukul975/anthropic-cybersecurity-skillsskills/hunting-for-data-staging-before-exfiltration/SKILL.md

    Detect data-staging activity (MITRE ATT&CK T1074) by analyzing EDR/Sysmon process-creation and file-system telemetry (Event ID 4688, Sysmon 1/11) for 7-Zip/RAR/tar archive creation, (SKILL.md metadata excerpt)

    Setup not establishedSource observation · Source example · File structure observedRead SKILL.md ↗Study method & source

  3. hunting-for-dcom-lateral-movement

    skill collectionNo comparison task assigned

    mukul975/anthropic-cybersecurity-skillsskills/hunting-for-dcom-lateral-movement/SKILL.md

    Hunt for DCOM-based lateral movement (MITRE ATT&CK T1021.003) by detecting abuse of MMC20.Application, ShellBrowserWindow, and ShellWindows COM objects via Sysmon Event ID (SKILL.md metadata excerpt)

    Setup not establishedSource observation · Source example · File structure observedRead SKILL.md ↗Study method & source

  4. hunting-for-dcom-lateral-movement

    skill collectionNo comparison task assigned

    byhartvig/agent-skills-collectiondevelopment-and-testing/cybersecurity-skills/hunting-for-dcom-lateral-movement/SKILL.md

    Hunt for DCOM-based lateral movement by detecting abuse of MMC20.Application, ShellBrowserWindow, and ShellWindows COM objects through Sysmon Event ID 1 (process creation) (SKILL.md metadata excerpt)

    Setup not establishedSource observation · Source example · File structure observedRead SKILL.md ↗Study method & source

  5. hunting-for-dcsync-attacks

    skill collectionNo comparison task assigned

    mukul975/anthropic-cybersecurity-skillsskills/hunting-for-dcsync-attacks/SKILL.md

    Detect DCSync attacks (MITRE ATT&CK T1003.006) by analyzing Windows Event ID 4662 (AccessMask 0x100) for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All requests issued by non-domain-controller (SKILL.md metadata excerpt)

    Setup not establishedSource observation · Source example · File structure observedRead SKILL.md ↗Study method & source

  6. hunting-for-dcsync-attacks

    skill collectionNo comparison task assigned

    byhartvig/agent-skills-collectiondevelopment-and-testing/cybersecurity-skills/hunting-for-dcsync-attacks/SKILL.md

    Detect DCSync attacks by analyzing Windows Event ID 4662 for unauthorized (SKILL.md metadata excerpt)

    Setup not establishedSource observation · Source example · File structure observedRead SKILL.md ↗Study method & source

  7. hunting-for-defense-evasion-via-timestomping

    skill collection

    byhartvig/agent-skills-collectiondevelopment-and-testing/cybersecurity-skills/hunting-for-defense-evasion-via-timestomping/SKILL.md

    Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT. Uses analyzeMFT and Python to identify files (SKILL.md metadata excerpt)

    Setup not establishedSource observation · Source example · File structure observedRead SKILL.md ↗Study method & source

  8. hunting-for-defense-evasion-via-timestomping

    skill collection

    mukul975/anthropic-cybersecurity-skillsskills/hunting-for-defense-evasion-via-timestomping/SKILL.md

    Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT. Uses analyzeMFT and Python to identify files (SKILL.md metadata excerpt)

    Setup not establishedSource observation · Source example · File structure observedRead SKILL.md ↗Study method & source

  9. hunting-for-dns-based-persistence

    skill collectionNo comparison task assigned

    mukul975/anthropic-cybersecurity-skillsskills/hunting-for-dns-based-persistence/SKILL.md

    Hunts for DNS-based persistence mechanisms such as DNS hijacking, dangling (SKILL.md metadata excerpt)

    Setup not establishedSource observation · Source example · File structure observedRead SKILL.md ↗Study method & source

  10. hunting-for-dns-based-persistence

    skill collectionNo comparison task assigned

    byhartvig/agent-skills-collectiondevelopment-and-testing/cybersecurity-skills/hunting-for-dns-based-persistence/SKILL.md

    Hunt for DNS-based persistence mechanisms including DNS hijacking, dangling (SKILL.md metadata excerpt)

    Setup not establishedSource observation · Source example · File structure observedRead SKILL.md ↗Study method & source

  11. hunting-for-dns-tunneling-with-zeek

    skill collectionNo comparison task assigned

    mukul975/anthropic-cybersecurity-skillsskills/hunting-for-dns-tunneling-with-zeek/SKILL.md

    Detects DNS tunneling and covert-channel data exfiltration by analyzing (SKILL.md metadata excerpt)

    Setup not establishedSource observation · Source example · File structure observedRead SKILL.md ↗Study method & source

  12. hunting-for-dns-tunneling-with-zeek

    skill collectionNo comparison task assigned

    byhartvig/agent-skills-collectiondevelopment-and-testing/cybersecurity-skills/hunting-for-dns-tunneling-with-zeek/SKILL.md

    Detect DNS tunneling and data exfiltration by analyzing Zeek dns.log (SKILL.md metadata excerpt)

    Setup not establishedSource observation · Source example · File structure observedRead SKILL.md ↗Study method & source

Snapshot w7-discovery-20260912 · 8364 file observations across 30 repositories. Source collection is not a quality or safety assessment.