Detects ransomware encryption activity in real time using entropy analysis, file system I/O monitoring (Sysmon, watchdog, psutil), and behavioral scoring to identify mass file modification, abnormal entropy spikes in written data, and suspicious process behavior characteristic of encryption routines.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-ransomware-encryption-behaviornpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-ransomware-encryption-behavior -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-ransomware-encryption-behavior -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/detecting-ransomware-encryption-behaviorgh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-ransomware-encryption-behaviorgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-ransomware-encryption-behavior ~/.claude/skills/detecting-ransomware-encryption-behavior # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-ransomware-encryption-behavior ~/.agents/skills/detecting-ransomware-encryption-behavior # Codex, Cursor, Gemini CLI, Copilot, OpenCode