Runs a hypothesis-driven threat hunt for command-and-control activity (T1071) by querying SIEM/EDR network telemetry for anomalous outbound traffic, rare destinations, non-standard ports, and unusual connection frequencies from endpoints. Use when hunting for beaconing/C2 traffic, after threat intel flags suspicious infrastructure, or when alerts fire on anomalous connections.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-unusual-network-connectionsnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-unusual-network-connections -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-unusual-network-connections -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/hunting-for-unusual-network-connectionsgh skill install mukul975/Anthropic-Cybersecurity-Skills hunting-for-unusual-network-connectionsgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/hunting-for-unusual-network-connections ~/.claude/skills/hunting-for-unusual-network-connections # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/hunting-for-unusual-network-connections ~/.agents/skills/hunting-for-unusual-network-connections # Codex, Cursor, Gemini CLI, Copilot, OpenCode