Runs a hypothesis-driven threat hunt for web shell deployment (T1505.003) on internet-facing servers by analyzing file creation in web directories, suspicious child-process spawning from web server processes, and anomalous HTTP request patterns.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-webshell-activitynpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-webshell-activity -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-webshell-activity -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/hunting-for-webshell-activitygh skill install mukul975/Anthropic-Cybersecurity-Skills hunting-for-webshell-activitygit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/hunting-for-webshell-activity ~/.claude/skills/hunting-for-webshell-activity # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/hunting-for-webshell-activity ~/.agents/skills/hunting-for-webshell-activity # Codex, Cursor, Gemini CLI, Copilot, OpenCode