Detect data staging activity before exfiltration by monitoring for archive creation with 7-Zip/RAR, unusual temp folder access, large file consolidation, and staging directory patterns via EDR and process telemetry
Works with
AI-first code editor with Composer
Before installing skills in Cursor, ensure your development environment meets these requirements:
node --versionhunting-for-data-staging-before-exfiltrationExecute the skills CLI command in your project's root directory to begin installation:
Fetches hunting-for-data-staging-before-exfiltration from mukul975/Anthropic-Cybersecurity-Skills and configures it for Cursor.
The CLI shows a list of agents. Use arrow keys and space to select Cursor:
Confirm successful installation by checking the skill directory location:
Restart Cursor to activate hunting-for-data-staging-before-exfiltration. Access via /hunting-for-data-staging-before-exfiltration in your agent's command palette.
We perform automated surface-level scans (Gen AI Scanner, Socket, Snyk) during installation. These checks detect common vulnerabilities but do not guarantee complete security. Always review skill source code and verify the publisher's reputation before production use.
Skills execute code in your environment. Always review source, verify the publisher, and test in isolation before production.
Submit your Claude Code skill and start earning
Quickly understand datasets, identify patterns, and generate insights
Example
Analyze CSV with 100K rows, identify outliers, visualize correlations, suggest hypotheses
Reduce EDA time from hours to minutes, uncover insights faster
Write scripts to clean messy data, handle missing values, normalize formats
Example
Generate Python/SQL to fix date formats, impute missing values, remove duplicates
Automate 80% of data preprocessing work
Perform hypothesis testing, regression, and statistical modeling
Example
Run A/B test analysis, calculate confidence intervals, interpret p-values
0
total installs
0
this week
8.6K
GitHub stars
0
upvotes
Run in your terminal
0
installs
0
this week
8.6K
stars
| name | hunting-for-data-staging-before-exfiltration |
| description | Detect data staging activity before exfiltration by monitoring for archive creation with 7-Zip/RAR, unusual temp folder access, large file consolidation, and staging directory patterns via EDR and process telemetry |
| domain | cybersecurity |
| subdomain | threat-hunting |
| tags | - data-staging - exfiltration - t1074 - archive-detection - edr - threat-hunting - dlp |
| version | '1.0' |
| author | mahipal |
| license | Apache-2.0 |
| d3fend_techniques | - File Metadata Consistency Validation - Content Format Conversion - File Content Analysis - Platform Hardening - File Format Verification |
| nist_csf | - DE.CM-01 - DE.AE-02 - DE.AE-07 - ID.RA-05 |
Before exfiltrating data, adversaries typically stage collected files in a central location (MITRE ATT&CK T1074). This involves creating archives with tools like 7-Zip, RAR, or tar, consolidating files from multiple directories, and using temporary or hidden staging directories. This skill detects staging behavior by analyzing process creation logs for archiver activity, monitoring file system events in common staging paths, and identifying anomalous file consolidation patterns.
Get statistically sound analysis without PhD in statistics
Create charts, dashboards, and visual reports
Example
Generate matplotlib/seaborn code for time series plots, distribution charts, heatmaps
Build presentation-ready visualizations 3x faster
Prerequisites
Time Estimate
20-40 minutes to set up and run first analysis
Steps
Common Pitfalls
✓ Do
✗ Don't
💡 Pro Tips
✓ Use when
Use for exploratory data analysis, data cleaning, statistical testing, visualization prototyping, and learning new analysis techniques. Best for initial exploration and rapid insights.
✗ Avoid when
Avoid for mission-critical financial analysis, medical research requiring regulatory compliance, production ML models, or when deep statistical expertise is required for nuanced interpretation.
mukul975/Anthropic-Cybersecurity-Skills
mukul975/Anthropic-Cybersecurity-Skills
mukul975/Anthropic-Cybersecurity-Skills
mukul975/Anthropic-Cybersecurity-Skills
mukul975/Anthropic-Cybersecurity-Skills
mukul975/Anthropic-Cybersecurity-Skills
hunting-for-data-staging-before-exfiltration reduced setup friction for our internal harness; good balance of opinion and flexibility.
We added hunting-for-data-staging-before-exfiltration from the explainx registry; install was straightforward and the SKILL.md answered most questions upfront.
I recommend hunting-for-data-staging-before-exfiltration for anyone iterating fast on agent tooling; clear intent and a small, reviewable surface area.
Registry listing for hunting-for-data-staging-before-exfiltration matched our evaluation — installs cleanly and behaves as described in the markdown.
hunting-for-data-staging-before-exfiltration fits our agent workflows well — practical, well scoped, and easy to wire into existing repos.
Keeps context tight: hunting-for-data-staging-before-exfiltration is the kind of skill you can hand to a new teammate without a long onboarding doc.
hunting-for-data-staging-before-exfiltration fits our agent workflows well — practical, well scoped, and easy to wire into existing repos.
hunting-for-data-staging-before-exfiltration reduced setup friction for our internal harness; good balance of opinion and flexibility.
hunting-for-data-staging-before-exfiltration is among the better-maintained entries we tried; worth keeping pinned for repeat workflows.
Useful defaults in hunting-for-data-staging-before-exfiltration — fewer surprises than typical one-off scripts, and it plays nicely with `npx skills` flows.
showing 1-10 of 73