hunt-credential-access

Name: hunt-credential-access
Availability: InStock
Author: DanDye

Hunt credential access techniques across SIEM telemetry using MITRE IDs and threat intel.

120|34|Updated May 9, 2025

Search Tags:#incident-response #credential #siem #threat-intel #hunt #mitre

Ready to run

npx skills add https://github.com/dandye/ai-runbooks --skill hunt-credential-access

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-credential-access
Source: https://github.com/dandye/ai-runbooks/tree/main/skills/hunt-credential-access
Command: npx skills add https://github.com/dandye/ai-runbooks --skill hunt-credential-access

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Credential access activities are a key attacker objective. This skill helps security teams proactively identify credential access techniques (e.g., LSASS dumping, browser credential theft) by searching for behavioral indicators across SIEM data using MITRE IDs and threat intel.

Core Features & Use Cases

Proactively hunt for MITRE ATT&CK credential access techniques (e.g., T1003.x, T1555.x) within SIEM telemetry.
Build targeted hunt queries from MITRE IDs and threat intel, run across time windows, and surface suspicious indicators.
Use case: Investigate suspected credential harvesting by correlating technique indicators with known threat intel to generate a case document and recommended mitigations.

Quick Start

Provide MITRE technique IDs to initiate a credential access hunt against your SIEM and return structured findings.

Frequently Asked Questions about hunt-credential-access

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I hunt for credential access techniques in SIEM telemetry?▼

You can hunt for credential access activities in SIEM by supplying MITRE technique IDs like T1003 or T1555. The skill correlates these IDs with threat intel to build targeted queries and surface suspicious credential harvesting indicators across your telemetry.

What MITRE ATT&CK techniques are used to detect LSASS dumping and browser credential theft?▼

MITRE ATT&CK techniques T1003 and T1555 are used to detect LSASS dumping and browser credential theft. The skill leverages these specific technique IDs to search SIEM telemetry and identify behavioral indicators of credential harvesting.

Can I investigate suspected credential harvesting using MITRE IDs and threat intel?▼

Yes, you can investigate suspected credential harvesting by correlating MITRE technique indicators with known threat intel. The skill analyzes SIEM telemetry to generate structured case documents and recommended mitigations for the identified activities.

Do I need threat intel access to hunt for credential access indicators across SIEM?▼

Yes, you need access to threat intel and SIEM telemetry to hunt for credential access indicators. The skill requires MITRE technique IDs and threat intel data to generate queries, run hunts, and produce actionable findings for your investigations.

What is the best way to proactively identify credential access activities in security investigations?▼

The best way to proactively identify credential access activities is by searching for behavioral indicators across SIEM data using MITRE IDs and threat intel. This approach helps security teams detect techniques like LSASS dumping and browser credential theft.

How do I build targeted hunt queries from MITRE IDs for credential access investigations?▼

You build targeted hunt queries from MITRE IDs by providing the technique IDs to initiate a hunt against your SIEM. The skill uses these IDs and threat intel to construct queries, run them across time windows, and return structured findings.