skills.rest
riparino
riparinoCOMMUNITY
Explore all skills by this author →
GitHub

defensive-exploit-detection

Correlate Windows application crashes with shell launches to detect exploit attempts.

1|Updated Apr 27, 2026
Search Tags:#incident-response#crash-analysis#kql#exploit-detection#windows-event-log#appcrashed
One-click install
npx skills add https://github.com/riparino/Claude-Cyber --skill defensive-exploit-detection
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: defensive-exploit-detection
Source: https://github.com/riparino/Claude-Cyber/tree/main/Claude-Blue/Skills/defensive-exploit-detection
Command: npx skills add https://github.com/riparino/Claude-Cyber --skill defensive-exploit-detection

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Detect exploit attempts by analyzing crash data to differentiate malicious exploitation from benign faults and enable rapid containment.

Core Features & Use Cases

  • Correlates AppCrashed events with subsequent shell processes (cmd.exe, powershell.exe) to identify exploitation attempts.
  • Flags DEP/CFG violations and high crash rates to trigger urgent incident response.
  • Provides KQL-based queries and guidance for SOC triage, incident response, and vulnerability remediation.
  • Useful for endpoint security, web service monitoring, and defensive blue-team workflows.

Quick Start

Load the defensive-exploit-detection skill and begin monitoring crash events and subsequent shell activity to triage suspected exploitation.

Frequently Asked Questions about defensive-exploit-detection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect exploit attempts using Windows event logs and crash analysis?▼

Exploit detection via crash analysis correlates AppCrashed Windows event logs with subsequent shell launches like cmd.exe or powershell.exe to identify malicious exploitation and trigger rapid incident response.

What is the best way to triage application crashes for potential security exploitation?▼

Triage application crashes for security exploitation by using KQL queries to check for DEP and CFG violations and flagging high crash rates to prioritize incident response workflows.

Can I use KQL to correlate application crashes with subsequent shell processes?▼

Yes, you can use KQL to correlate application crashes with subsequent shell processes by querying Windows event logs for AppCrashed events followed by memory-violation indicators.

Why does differentiating malicious exploitation from benign application faults matter?▼

Differentiating malicious exploitation from benign application faults matters because it prevents false positives in SOC environments and ensures urgent incident response targets actual memory violations.

Does this exploit detection approach work for endpoint security and blue-team workflows?▼

Yes, this exploit detection approach works for endpoint security and blue-team workflows by analyzing Windows-based processes and endpoint applications to identify suspected exploitation.

Related Skills

Explore More Software Engineering Skills→
riparinoriparino
1

defensive-basic-exploitation

Detect basic exploitation crashes from stack/heap overflows, use-after-free, and format-string indicators.

Community
Intermediate
thoreinsteinthoreinstein
5

incident

Generate prioritized triage checklists for production incidents and log findings to Obsidian.

Community
Intermediate
riparinoriparino
1

defensive-crash-analysis

Analyze Windows crash telemetry to determine exploitability and identify exploitation patterns.

Community
Intermediate
blouargantblouargant

k8s-log-investigation

Investigate Kubernetes pod log streams for failure signals with progressive context expansion.

Community
Intermediate