SkillCheatSheet
hunting-for-unusual-service-installations
An AI agent skill from mukul975/Anthropic-Cybersecurity-Skills, scored 63 out of 100 by code.
Code score by group
It loses the most points in Done criteria (15), the group that checks whether there is a checklist and a step that verifies the work.
What the author says it does
Detects suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event log Event ID 7045, analyzing service binary paths, and flagging indicators of persistence mechanisms via Sysmon/EDR telemetry. Use when hunting for new-service persistence after a suspected compromise, when Event ID 7045 fires for an unfamiliar service, or during incident response to enumerate service-based persistence on Windows hosts.
This is the description in the skill's own SKILL.md, written by its author, not by SkillCheatSheet.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Folder
- skills/hunting-for-unusual-service-installations
- License
- Apache-2.0
- GitHub stars
- 35,958
- SKILL.md lines
- 71
- Other files
- 3
Add hunting-for-unusual-service-installations to your agent
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-unusual-service-installationsThe command uses the open skills CLI. A skill is instructions and scripts your agent will follow, so read it first: open the folder on GitHub at the commit that was scored.
More skills from mukul975/Anthropic-Cybersecurity-Skills
-
exploiting-adcs-with-certipy
Use Certipy to enumerate AD CS certificate authorities and templates over LDAP/RPC, then exploit ESC1-ESC16 misconfigurations - SAN abuse, NTLM relay to web enrollment (ESC8), Sha…
Verified84B -
auditing-tls-certificate-transparency-logs
Monitors Certificate Transparency (CT) logs to detect unauthorized certificate issuance, discover subdomains via CT data, and alert on suspicious certificate activity for owned do…
Verified82B -
conducting-api-security-testing
Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic. The te…
Verified82B -
conducting-gdpr-compliance-assessment
Conduct comprehensive GDPR compliance assessments by evaluating data processing activities against EU Regulation 2016/679, including Article 30 records of processing, lawful basis…
Verified82B -
detecting-container-runtime-threats-with-falco
Deploys and operates Falco with the modern eBPF driver in Kubernetes and Docker, covering driver selection, Helm installation, output channels, and the built-in ruleset that detec…
Verified82B -
detecting-typosquatting-packages
Flag misspelled, brandjacked, and typosquatted package names across npm, PyPI, and crates.io before installation, using edit-distance, keyboard-proximity, and known-target corpus…
Verified82B -
performing-access-review-and-certification
Designs and runs access review and certification campaigns-scoping, reviewer selection, risk-based prioritization, micro-certification, and remediation tracking-to verify user acc…
Verified82B -
assessing-vector-and-embedding-weaknesses
Test RAG vector stores (Pinecone, Qdrant, Weaviate, Chroma, pgvector, FAISS) for embedding inversion, cross-tenant data leakage, and data poisoning per OWASP LLM08:2025. Use when…
Verified81B
All skills in mukul975/Anthropic-Cybersecurity-Skills
Scores come from a snapshot of 300 public GitHub repositories taken on 12 November 2026. Every score is the result of fixed checks run by code; no AI is involved. How scoring works.