skills.rest
balsm-health
balsm-healthOFFICIAL
Explore all skills by this author →
Website𝕏@balsm_healthGitHub

detecting-credential-dumping-techniques

Detect credential dumping techniques in Sysmon and Windows Security logs.

2|Updated Jun 5, 2026
Search Tags:#risk assessment#cybersecurity#malware detection#siem#sysmon#credential dumping#windows security logs
One-click install
npx skills add https://github.com/balsm-health/Balsm-AI --skill detecting-credential-dumping-techniques
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-credential-dumping-techniques
Source: https://github.com/balsm-health/Balsm-AI/tree/main/plugin/skills/detecting-credential-dumping-techniques
Command: npx skills add https://github.com/balsm-health/Balsm-AI --skill detecting-credential-dumping-techniques

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires python, pysysmon, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps in identifying advanced credential dumping techniques that cyber adversaries use to extract sensitive information from a system.

Core Features & Use Cases

  • Credential Dumping Detection: Identifies activities such as LSASS memory access, SAM database extraction, and NTDS.dit theft.
  • Security Monitoring: Integrates with SIEMs like Splunk or Elastic for enhanced security monitoring.
  • Automated Analysis: Automatically parses Sysmon event logs and Windows Security logs for suspicious activity.

Quick Start

Run the detection script with the path to your Sysmon event log XML export file.

Frequently Asked Questions about detecting-credential-dumping-techniques

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect LSASS credential dumping and NTDS.dit theft in Windows logs?▼

You can detect credential dumping by running the Python script against your Sysmon event log XML export file to automatically parse and analyze suspicious activities like LSASS memory access and NTDS.dit theft.

What credential dumping techniques can be identified using Sysmon logs?▼

Sysmon logs help identify credential dumping techniques including LSASS memory access, SAM database extraction, and NTDS.dit theft by analyzing suspicious process activities and correlating them with contextual data to score risk.

Do I need an SIEM platform to analyze Windows Security logs for credential dumping?▼

Yes, an SIEM platform is required. The Skill integrates with SIEMs like Splunk or Elastic for enhanced security monitoring and correlates parsed Sysmon and Windows Security logs to score credential dumping risk.

How do I set up automated analysis for SAM database extraction detection?▼

Set up automated analysis for SAM database extraction detection by running the provided Python script with your Sysmon event log XML export file, which automatically parses logs and correlates suspicious activity to score risk.

Can I use Python and pysysmon to monitor for advanced credential dumping techniques?▼

Yes, the Skill requires Python and pysysmon to detect advanced credential dumping techniques, automatically analyzing Sysmon and Windows Security logs for LSASS access and NTDS.dit theft to secure your systems.

Related Skills

balsm-healthbalsm-health
2

hunting-for-webshell-activity

Detect webshell deployments by analyzing process creation, network, and web access logs.

Official
Advanced
MHaggisMHaggis
471

threat-report-parser

Parse threat reports and generate SIEM-specific detection rules mapped to MITRE ATT&CK.

Community
Advanced
ZateZate
9

tool-usage-policy

Standardize tool usage for file operations with approved tools and parallelization rules.

Community
Basic
dreadnodedreadnode
11

credential-theft-hunt

Recover credentials and detect credential-theft tradecraft from Windows memory images with Volatility 3 and YARA.

Official
Advanced