Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-evasion-techniques-in-endpoint-logsnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-evasion-techniques-in-endpoint-logs -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-evasion-techniques-in-endpoint-logs -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/detecting-evasion-techniques-in-endpoint-logsgh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-evasion-techniques-in-endpoint-logsgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-evasion-techniques-in-endpoint-logs ~/.claude/skills/detecting-evasion-techniques-in-endpoint-logs # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-evasion-techniques-in-endpoint-logs ~/.agents/skills/detecting-evasion-techniques-in-endpoint-logs # Codex, Cursor, Gemini CLI, Copilot, OpenCode