Identifies unauthorized credential usage by analyzing NTLM authentication patterns and correlating them with credential dumping activities.
This skill empowers Claude to act as a specialized threat hunter for identifying Pass-the-Hash (PtH) attacks within enterprise Windows environments. It provides a structured methodology for analyzing NTLM authentication patterns, specifically detecting anomalous Type 3 logons where Kerberos is the expected protocol. By leveraging telemetry from EDR platforms like CrowdStrike and Microsoft Defender for Endpoint, along with SIEM logs from Splunk or Elastic, this skill enables security professionals to proactively discover lateral movement and unauthorized access indicators across the attack surface.
主要功能
010 GitHub stars
02Correlation with credential dumping (MITRE T1550.002)
03NTLM authentication pattern analysis
04Standardized threat hunting reporting format
05Cross-platform query generation for EDR and SIEM tools
06Type 3 logon anomaly detection
使用场景
01Incident response scoping following a suspected credential breach
02Proactive threat hunting for lateral movement indicators
03Purple team exercises to validate organizational defensive coverage
