Detects lateral movement techniques including Pass-the-Hash, PsExec, WMI execution, RDP pivoting, and SMB-based spreading by correlating Windows Security/Sysmon event logs, network flow data (NetFlow/Zeek), and endpoint telemetry in a SIEM, mapped to MITRE ATT&CK Lateral Movement (TA0008) techniques with sample SPL detection queries.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-lateral-movement-detectionnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-lateral-movement-detection -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-lateral-movement-detection -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/performing-lateral-movement-detectiongh skill install mukul975/Anthropic-Cybersecurity-Skills performing-lateral-movement-detectiongit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/performing-lateral-movement-detection ~/.claude/skills/performing-lateral-movement-detection # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/performing-lateral-movement-detection ~/.agents/skills/performing-lateral-movement-detection # Codex, Cursor, Gemini CLI, Copilot, OpenCode