mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-08-02 09:07:41 +03:00
mukul975
c47eed6a64
- Fix 25 shell=True subprocess calls with list-based commands - Fix 49 verify=False in defensive skills (env-var override) - Add timeout to 231 HTTP/subprocess/socket calls - Fix 6 SQL injection patterns with whitelist validation - Replace 8 __import__() with standard imports - Remove 701 unused imports across 442 files - Add authorized-testing disclaimers to all offensive skills - Complete 11 incomplete skill directories - Expand 10 stub SKILL.md files with full content - Fix 2 YAML parse errors in frontmatter - Fix 5 pre-existing syntax errors - Convert 22 hardcoded paths/ports to environment variables - Back up 21 redundant skill pairs to .bak - Fix 2 global declaration errors - 724/724 skills with full folder anatomy (SKILL.md + agent.py + api-reference.md + LICENSE) - 0 compile errors across all 724 agent.py files
1.8 KiB
1.8 KiB
Credential Dumping Hunt Template
Hunt Metadata
| Field | Value |
|---|---|
| Hunt ID | TH-CRED-DUMP-YYYY-MM-DD-NNN |
| Analyst | |
| Date | |
| Status | [ ] In Progress / [ ] Complete |
Hypothesis
[e.g., "Adversaries have used Mimikatz or similar tools to dump LSASS memory on compromised endpoints to harvest domain credentials."]
Target Techniques
- T1003.001 - LSASS Memory
- T1003.002 - SAM Database
- T1003.003 - NTDS.dit
- T1003.004 - LSA Secrets
- T1003.005 - Cached Domain Credentials
- T1003.006 - DCSync
Data Sources
- Sysmon Event ID 10 (Process Access)
- Sysmon Event ID 1 (Process Creation)
- Windows Security 4656/4663
- Windows Security 4662 (DCSync)
- EDR Telemetry: _______________
LSASS Access Findings
| # | Timestamp | Host | User | Source Process | Access Mask | Risk | Verdict |
|---|---|---|---|---|---|---|---|
| 1 | |||||||
| 2 |
Tool Detection Findings
| # | Timestamp | Host | User | Tool | Command Line | Technique | Verdict |
|---|---|---|---|---|---|---|---|
| 1 | |||||||
| 2 |
DCSync Findings
| # | Timestamp | Source Host | User | Replication Right | Is Legitimate DC? | Verdict |
|---|---|---|---|---|---|---|
| 1 |
Compromised Credentials Assessment
| Account | Type | Hash Type | Exposure Scope | Reset Required? |
|---|---|---|---|---|
Recommendations
- Immediate Actions: [Password resets, account lockouts]
- Containment: [Isolate affected systems]
- Detection Improvements: [New rules, LSASS protection]
- Hardening: [Credential Guard, PPL, ASR rules]