creator/Anthropic-Cybersecurity-Skills
1
0
Fork 0
mirror of https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git synced 2026-09-03 06:50:51 +03:00
Code Issues Packages Projects Releases Wiki Activity

Expand 39 api-reference stubs with real tool docs, expand 15 agent.py boilerplate stubs

Browse Source
This commit is contained in:
mukul975
2026-03-19 13:29:50 +01:00
parent d63b578a2f
commit d005ae764b
191 changed files with 4300 additions and 587 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/hunting-for-process-injection-techniques/SKILL.md
+8
View File
@@ -15,6 +15,14 @@ license: Apache-2.0
Process injection (MITRE ATT&CK T1055) allows adversaries to execute code in the address space of another process, enabling defense evasion and privilege escalation. This skill detects injection techniques via Sysmon Event ID 8 (CreateRemoteThread), Event ID 10 (ProcessAccess with suspicious access rights), and analysis of source-target process relationships to distinguish legitimate from malicious injection.
## When to Use
- When investigating security incidents that require hunting for process injection techniques
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
## Prerequisites
- Sysmon installed with Event IDs 8 and 10 enabled