Anthropic-Cybersecurity-Skills/skills/detecting-living-off-the-land-attacks/SKILL.md

name, description, domain, subdomain, tags, version, author, license

name	description	domain	subdomain	tags	version	author	license
detecting-living-off-the-land-attacks	Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process creation, command-line arguments, and parent-child relationships to identify suspicious LOLBin execution patterns.	cybersecurity	threat-detection	lolbins lotl fileless-attacks process-monitoring	1.0	mahipal	Apache-2.0

Detecting Living Off the Land Attacks

Monitor for suspicious use of legitimate Windows binaries (LOLBins) including certutil, mshta, rundll32, regsvr32, and others used in fileless and living-off-the-land attack techniques.