Detect process injection techniques (T1055) - including DLL injection, process hollowing, and APC injection - by analyzing Sysmon Event IDs 1, 7, 8, 10, and 25 for cross-process memory operations, remote thread creation, and anomalous DLL loads.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-t1055-process-injection-with-sysmonnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-t1055-process-injection-with-sysmon -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-t1055-process-injection-with-sysmon -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/detecting-t1055-process-injection-with-sysmongh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-t1055-process-injection-with-sysmongit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-t1055-process-injection-with-sysmon ~/.claude/skills/detecting-t1055-process-injection-with-sysmon # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-t1055-process-injection-with-sysmon ~/.agents/skills/detecting-t1055-process-injection-with-sysmon # Codex, Cursor, Gemini CLI, Copilot, OpenCode