Agent skill
Detecting Credential Dumping Techniques
Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft using Sysmon Event ID 10, Windows
OpenClawDevelopment & Engineering
xalgord603
Apache-2.0View resource
Agent skills
Reusable instructions for compatible AI agents.
Explore by field
Loading catalog totals…Field counts come from the latest full-catalog snapshot. A resource can belong to several fields and platforms.
Resources
Search resultsAgent skill
Security Joes AI Analyst
SecOps checks for endpoints: EDR, Sysmon, updates, EVTX on heartbeat, least privilege, network visibility, credential protection (Kerberos/NTLM/pass-the-hash), device inventory and known vulnerabilities, weekly assessment, and skill integrity (hash-on-wake, version-aware). Use when implementing o...
OpenClawDevelopment & Engineering
Demerzels-lab9
Agent skill
Hunting for DCOM Lateral Movement
Hunt for DCOM-based lateral movement by detecting abuse of MMC20.Application,
OpenClawDevelopment & Engineering
26zl8
Apache-2.0View resource
Agent skill
Hunting for Process Injection Techniques
Detect process injection techniques (T1055) including CreateRemoteThread,
OpenClawDevelopment & Engineering
26zl8
Apache-2.0View resource
Agent skill
Hunting for LOLBins Execution in Endpoint Logs
Hunt for adversary abuse of Living Off the Land Binaries (LOLBins) by
ClaudeCodexOpenClawData & Analytics
26zl8
Apache-2.0View resource
Agent skill
Detecting DLL Sideloading Attacks
Detect DLL side-loading attacks where adversaries place malicious DLLs
ClaudeCodexOpenClawDevelopment & Engineering
costrict-plugins-repo8
Apache-2.0View resource
Agent skill
Detecting Evasion Techniques in Endpoint Logs
Detects defense evasion techniques used by adversaries in endpoint logs
OpenClawData & Analytics
costrict-plugins-repo8
Apache-2.0View resource
Agent skill
Detecting Living Off the Land Attacks
Detect abuse of legitimate Windows binaries (LOLBins) used for living
OpenClawDevelopment & Engineering
costrict-plugins-repo8
Apache-2.0View resource
Agent skill
Detecting Malicious Scheduled Tasks with Sysmon
Detect malicious scheduled task creation and modification using Sysmon
ClaudeCodexCursorDevelopment & Engineering
costrict-plugins-repo8
Apache-2.0View resource
Agent skill
Detecting Living Off the Land with LOLBAS
Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including
ClaudeCodexOpenClawDevelopment & Engineering
costrict-plugins-repo8
Apache-2.0View resource
Agent skill
Detecting Process Injection Techniques
Detects and analyzes process injection techniques used by malware including
OpenClawDevelopment & Engineering
costrict-plugins-repo8
Apache-2.0View resource
Agent skill
Detecting Ransomware Encryption Behavior
Detects ransomware encryption activity in real time using entropy analysis,
ClaudeCodexOpenClawDevelopment & Engineering
costrict-plugins-repo8
Apache-2.0View resource
No matching resources
Try a broader search or clear some filters.
Platform labels describe intended use. Read each resource's author credits, requirements and available access methods.