Anthropic-Cybersecurity-Skills/skills/detecting-service-account-abuse/SKILL.md

name, description, domain, subdomain, tags, version, author, license, d3fend_techniques, nist_csf, mitre_attack

name	description	domain	subdomain	tags	version	author	license	d3fend_techniques	nist_csf	mitre_attack
detecting-service-account-abuse	Detect abuse of service accounts through anomalous interactive logons, privilege escalation, lateral movement, and unauthorized access patterns.	cybersecurity	threat-hunting	threat-hunting mitre-attack service-accounts privilege-escalation t1078 proactive-detection	1.0	mahipal	Apache-2.0	Restore Access Password Authentication Biometric Authentication Strong Password Policy Restore User Account Access	DE.CM-01 DE.AE-02 DE.AE-07 ID.RA-05	T1078.002 T1021.001 T1098.001 T1550.002

Detecting Service Account Abuse

When to Use

• When proactively hunting for indicators of detecting service account abuse in the environment
• After threat intelligence indicates active campaigns using these techniques
• During incident response to scope compromise related to these techniques
• When EDR or SIEM alerts trigger on related indicators
• During periodic security assessments and purple team exercises

Prerequisites

• EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)
• SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)
• Sysmon deployed with comprehensive configuration
• Windows Security Event Log forwarding enabled
• Threat intelligence feeds for IOC correlation

Workflow

1. Formulate Hypothesis: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.
2. Identify Data Sources: Determine which logs and telemetry are needed to validate or refute the hypothesis.
3. Execute Queries: Run detection queries against SIEM and EDR platforms to collect relevant events.
4. Analyze Results: Examine query results for anomalies, correlating across multiple data sources.
5. Validate Findings: Distinguish true positives from false positives through contextual analysis.
6. Correlate Activity: Link findings to broader attack chains and threat actor TTPs.
7. Document and Report: Record findings, update detection rules, and recommend response actions.

Key Concepts

Concept	Description
T1078.002	Domain Accounts
T1078.001	Default Accounts
T1021	Remote Services

Tools & Systems

Tool	Purpose
CrowdStrike Falcon	EDR telemetry and threat detection
Microsoft Defender for Endpoint	Advanced hunting with KQL
Splunk Enterprise	SIEM log analysis with SPL queries
Elastic Security	Detection rules and investigation timeline
Sysmon	Detailed Windows event monitoring
Velociraptor	Endpoint artifact collection and hunting
Sigma Rules	Cross-platform detection rule format

Common Scenarios

1. Scenario 1: Service account RDP to domain controller
2. Scenario 2: SQL service accessing file shares outside scope
3. Scenario 3: Backup service lateral movement off-hours
4. Scenario 4: Compromised svc with DA privileges used for DCSync

Output Format

Hunt ID: TH-DETECT-[DATE]-[SEQ]
Technique: T1078.002
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]