skills.rest
op7ic
op7icCOMMUNITY
Explore all skills by this author →
GitHub

Hunt: Credential Theft Detection

Enumerate credential dumping tools and LSASS access attempts across endpoints.

14|5|Updated May 14, 2020
Search Tags:#detection#endpoint#hashing#forensics#threat-hunting#lsass#credential-theft
One-click install
npx skills add https://github.com/op7ic/amphunt --skill hunt-credential-theft-detection
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Hunt: Credential Theft Detection
Source: https://github.com/op7ic/amphunt/tree/main/SKILLS/.claude/skills/hunt-credentials
Command: npx skills add https://github.com/op7ic/amphunt --skill hunt-credential-theft-detection

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Detects credential dumping tools, LSASS access attempts, and credential harvesting activity across the environment to identify post-compromise activity.

Core Features & Use Cases

  • Combines hash-based detection of known credential tools, C2 connection discovery, and keyword searches to surface credential theft activity.
  • Enables post-compromise investigations and proactive hunting across enterprise endpoints.
  • Orchestrates three scripts to provide end-to-end credential-theft detection.

Quick Start

Run hash2processarg.py, hash2connection.py, and multikeyword_search.py to detect credential theft across the environment.

Frequently Asked Questions about Hunt: Credential Theft Detection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect credential theft and LSASS access attempts across enterprise endpoints?▼

Detect credential theft by running hash2processarg.py, hash2connection.py, and multikeyword_search.py to enumerate credential dumping tools, LSASS access attempts, and harvesting activity across endpoints.

What is the best way to hunt for credential dumping tools in endpoint telemetry?▼

Hunt for credential dumping tools using hash-based detection combined with C2 connection discovery and keyword searches to surface credential theft activity across endpoint telemetry.

Can I use this for proactive credential hunting or is it only for post-compromise investigations?▼

You can use this for both proactive credential hunting and post-compromise investigations across enterprise environments, provided you have access to endpoint telemetry.

Do I need endpoint telemetry to run these credential theft detection scripts?▼

Yes, endpoint telemetry access is required to run the three analysis scripts that enumerate credential dumping tools, LSASS access attempts, and credential harvesting activity.

How does hash-based detection identify known credential tools across endpoints?▼

Hash-based detection identifies known credential tools by mapping file hashes to process arguments and network connections, enabling discovery of credential theft tools and associated C2 activity.

Related Skills

Explore More Data & Analytics Skills→
riparinoriparino
1

defensive-threat-hunting

Run hypothesis-driven threat hunts with KQL queries and MITRE mappings.

Community
Advanced
dreadnodedreadnode
11

credential-theft-hunt

Recover credentials and detect credential-theft tradecraft from Windows memory images with Volatility 3 and YARA.

Official
Advanced
dandyedandye
120

hunt-credential-access

Hunt credential access techniques across SIEM telemetry using MITRE IDs and threat intel.

Community
Intermediate
balsm-healthbalsm-health
2

detecting-credential-dumping-techniques

Detect credential dumping techniques in Sysmon and Windows Security logs.

Official
Advanced