← LeaderboardThe Skill Leaderboard

implementing-cloud-workload-protection

Implements cloud workload protection using boto3 and google-cloud APIs for runtime security monitoring, process anomaly detection, and file integrity checking on EC2/GCE instances. Scans for cryptomining, reverse shells, and unauthorized binaries. Use when building runtime security controls for cloud compute workloads.

Published by mukul975 ↗mukul975/Anthropic-Cybersecurity-Skills

Try your first task

Start a fresh conversation. Replace the highlighted placeholders.

Use implementing-cloud-workload-protection to design and implement runtime threat monitoring for [authorized cloud lab workload], covering process, network, file-integrity, and resource-utilization anomalies.

Required inputs

[authorized cloud lab workload]

User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗

SKILL.md

name: implementing-cloud-workload-protectiondescription: 'Implements cloud workload protection using boto3 and google-cloud APIs  for runtime security monitoring, process anomaly detection, and file integrity checking  on EC2/GCE instances. Scans for cryptomining, reverse shells, and unauthorized binaries.  Use when building runtime security controls for cloud compute workloads.  'domain: cybersecuritysubdomain: cloud-securitytags: - cloud-security- cwpp- workload-protection- boto3- runtime-security- process-anomaly-detectionversion: '1.0'author: mahipallicense: Apache-2.0nist_csf: - PR.IR-01- ID.AM-08- GV.SC-06- DE.CM-01mitre_attack: - T1078.004- T1530- T1537- T1580- T1071

Implementing Cloud Workload Protection

When to Use

When deploying or configuring implementing cloud workload protection capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Familiarity with cloud security concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Instructions

Monitor cloud workloads for runtime threats by checking process lists, network connections, file integrity, and resource utilization anomalies.

import boto3

ssm = boto3.client("ssm")
# Run command on EC2 instances to check for suspicious processes
response = ssm.send_command(
    InstanceIds=["i-1234567890abcdef0"],
    DocumentName="AWS-RunShellScript",
    Parameters={"commands": ["ps aux | grep -E 'xmrig|minerd|cryptonight'"]},
)

Key protection areas:

Process monitoring for cryptominers and reverse shells
File integrity monitoring on critical system files
Network connection auditing for C2 callbacks
Resource utilization anomaly detection (CPU spikes)
Unauthorized binary detection via hash comparison

Examples

# Check for unauthorized outbound connections
ssm.send_command(
    InstanceIds=instances,
    DocumentName="AWS-RunShellScript",
    Parameters={"commands": ["ss -tlnp | grep ESTABLISHED"]},
)