creator/Anthropic-Cybersecurity-Skills
1
0
Fork 0
mirror of https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git synced 2026-08-04 18:00:18 +03:00
Code Issues Packages Projects Releases Wiki Activity

Rewrite 548 skill descriptions to the activation rubric

Browse Source 
Each rewritten description now states both what the skill does (concrete
capability, named tools/artifacts) and an explicit when-to-use trigger,
improving agent discovery/activation. Grounded in each skill's own body;
changes confined to the `description` field only (bodies and all other
frontmatter untouched). Produced by a gated audit->rewrite->recheck loop
(548 -> 0 flagged) with a sampled anti-invention check (0 ungrounded).

Schema: 817/817 pass. Framework-ID gate: 0 defects.
This commit is contained in:
Mahipal
2026-08-02 09:32:13 -07:00
parent 04a207702e
commit 2fb6a9faff
548 changed files with 2189 additions and 1915 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/detecting-t1055-process-injection-with-sysmon/SKILL.md
+6 -3
View File
@@ -1,8 +1,11 @@
---
name: detecting-t1055-process-injection-with-sysmon
description: Detect process injection techniques (T1055) including classic DLL injection,
process hollowing, and APC injection by analyzing Sysmon events for cross-process
memory operations, remote thread creation, and anomalous DLL loading patterns.
description: Detect process injection techniques (T1055) - including DLL injection, process
hollowing, and APC injection - by analyzing Sysmon Event IDs 1, 7, 8, 10, and 25 for
cross-process memory operations, remote thread creation, and anomalous DLL loads. Use
when hunting defense-evasion activity that hides code inside legitimate processes, investigating
an EDR alert on suspicious cross-process access, or validating Sysmon coverage for injection
detection.
domain: cybersecurity
subdomain: threat-hunting
tags: