Stats
Actions
Tags
From cybersec-toolkit
Parses Windows System event logs for Event ID 7045 to detect suspicious service installations, analyzes binary paths for persistence indicators (MITRE T1543.003), and generates risk reports.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cybersec-toolkit:hunting-for-unusual-service-installationsThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Attackers frequently install malicious Windows services for persistence and privilege escalation (MITRE ATT&CK T1543.003 — Create or Modify System Process: Windows Service). Event ID 7045 in the System event log records every new service installation. This skill parses .evtx log files to extract service installation events, flags suspicious binary paths (temp directories, PowerShell, cmd.exe, e...
Attackers frequently install malicious Windows services for persistence and privilege escalation (MITRE ATT&CK T1543.003 — Create or Modify System Process: Windows Service). Event ID 7045 in the System event log records every new service installation. This skill parses .evtx log files to extract service installation events, flags suspicious binary paths (temp directories, PowerShell, cmd.exe, encoded commands), and correlates with known attack patterns.
python-evtx, lxmlnpx claudepluginhub 26zl/cybersec-toolkit --plugin cybersec-toolkitDetects suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event logs for Event ID 7045, analyzing binary paths, and identifying persistence indicators. Useful for threat hunting and incident response.
Detects suspicious Windows service installations by parsing Event ID 7045 from System event logs, analyzing binary paths for persistence indicators (MITRE ATT&CK T1543.003).
Detects suspicious Windows service installations by parsing event ID 7045 from System.evtx logs, analyzing binary paths and PowerShell patterns for persistence (MITRE T1543.003). Useful for threat hunting.