Hunt for adversary persistence via Windows Scheduled Tasks by analyzing task creation events, suspicious task actions, and unusual scheduling patterns.
Automate repetitive workflows and reduce manual effort
Example: Generate reports, summarize documents, draft communications
Save 3-5 hours per week on routine tasks
Learn new skills, understand complex topics, get expert guidance
Example: Explain concepts, provide examples, suggest learning resources
Accelerate learning and skill development by 2x
Enhance output quality through reviews, suggestions, and refinements
Example: Review drafts, suggest improvements, catch errors
Improve work quality by 30-40% with less effort
Time estimate: 15-45 minutes depending on use case complexity
Prerequisites
Submit your Claude Code skill and start earning
epx add mukul975/Anthropic-Cybersecurity-Skills/hunting-for-scheduled-task-persistenceCompatible with
Supported agents
| name | hunting-for-scheduled-task-persistence |
| description | Hunt for adversary persistence via Windows Scheduled Tasks by analyzing task creation events, suspicious task actions, and unusual scheduling patterns. |
| domain | cybersecurity |
| subdomain | threat-hunting |
| tags | - threat-hunting - mitre-attack - scheduled-tasks - persistence - t1053 - proactive-detection |
| version | '1.0' |
| author | mahipal |
| license | Apache-2.0 |
| d3fend_techniques | - Execution Isolation - Process Termination - Hardware-based Process Isolation - Platform Monitoring - Process Suspension |
| nist_csf | - DE.CM-01 - DE.AE-02 - DE.AE-07 - ID.RA-05 |
| Concept | Description |
|---|---|
| T1053.005 | Scheduled Task |
| T1053.003 | Cron |
| T1053.002 | At |
| Tool | Purpose |
|---|---|
| CrowdStrike Falcon | EDR telemetry and threat detection |
| Microsoft Defender for Endpoint | Advanced hunting with KQL |
| Splunk Enterprise | SIEM log analysis with SPL queries |
| Elastic Security | Detection rules and investigation timeline |
| Sysmon | Detailed Windows event monitoring |
| Velociraptor | Endpoint artifact collection and hunting |
| Sigma Rules | Cross-platform detection rule format |
Hunt ID: TH-HUNTIN-[DATE]-[SEQ]
Technique: T1053.005
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]
AI-first code editor with Composer
Before installing skills in Cursor, ensure your development environment meets these requirements:
node --versionhunting-for-scheduled-task-persistenceExecute the skills CLI command in your project's root directory to begin installation:
epx add mukul975/Anthropic-Cybersecurity-Skills/hunting-for-scheduled-task-persistenceFetches hunting-for-scheduled-task-persistence from mukul975/Anthropic-Cybersecurity-Skills and configures it for Cursor.
The CLI shows a list of agents. Use arrow keys and space to select Cursor:
Confirm successful installation by checking the skill directory location:
.cursor/skills/hunting-for-scheduled-task-persistence
Restart Cursor to activate hunting-for-scheduled-task-persistence. Access via /hunting-for-scheduled-task-persistencein your agent's command palette.
Learn more:View source on GitHubSkills CLI docsAbout CursorWhat are agent skills?
Steps
Common Pitfalls
✓ Do
✗ Don't
💡 Pro Tips
✓ Use when
Use when skill capabilities match your task, clear ROI on time saved, and you can validate outputs. Best for repetitive tasks, learning, and quality improvement.
✗ Avoid when
Avoid when task requires deep expertise you can't validate, involves sensitive decisions, or when learning process is more valuable than speed of completion.
analyzing-windows-event-logs-in-splunk
mukul975/Anthropic-Cybersecurity-Skills · analyzing-windows-event-logs-in-splunk · same repo
performing-steganography-detection
mukul975/Anthropic-Cybersecurity-Skills · performing-steganography-detection · same repo
performing-cryptographic-audit-of-application
mukul975/Anthropic-Cybersecurity-Skills · performing-cryptographic-audit-of-application · same repo
building-red-team-c2-infrastructure-with-havoc
mukul975/Anthropic-Cybersecurity-Skills · building-red-team-c2-infrastructure-with-havoc · same repo
performing-mobile-device-forensics-with-cellebrite
mukul975/Anthropic-Cybersecurity-Skills · performing-mobile-device-forensics-with-cellebrite · same repo
reverse-engineering-dotnet-malware-with-dnspy
mukul975/Anthropic-Cybersecurity-Skills · reverse-engineering-dotnet-malware-with-dnspy · same repo
hunting-for-scheduled-task-persistence fits our agent workflows well — practical, well scoped, and easy to wire into existing repos.
Keeps context tight: hunting-for-scheduled-task-persistence is the kind of skill you can hand to a new teammate without a long onboarding doc.
hunting-for-scheduled-task-persistence has been reliable in day-to-day use. Documentation quality is above average for community skills.
I recommend hunting-for-scheduled-task-persistence for anyone iterating fast on agent tooling; clear intent and a small, reviewable surface area.
We added hunting-for-scheduled-task-persistence from the explainx registry; install was straightforward and the SKILL.md answered most questions upfront.
hunting-for-scheduled-task-persistence fits our agent workflows well — practical, well scoped, and easy to wire into existing repos.
We added hunting-for-scheduled-task-persistence from the explainx registry; install was straightforward and the SKILL.md answered most questions upfront.
Keeps context tight: hunting-for-scheduled-task-persistence is the kind of skill you can hand to a new teammate without a long onboarding doc.
Useful defaults in hunting-for-scheduled-task-persistence — fewer surprises than typical one-off scripts, and it plays nicely with `npx skills` flows.
Registry listing for hunting-for-scheduled-task-persistence matched our evaluation — installs cleanly and behaves as described in the markdown.
showing 1-10 of 51