Detecting Credential Dumping Techniques
FreeIdentify and respond to credential theft on Windows systems.
Free · Opens the source repo
What Detecting Credential Dumping Techniques does
Detecting Credential Dumping Techniques is a specialized skill designed for security professionals focused on identifying and mitigating credential theft within Windows environments. This skill leverages Sysmon Event ID 10 to monitor LSASS memory access, which is critical for detecting various credential dumping methods such as those employed by tools like Mimikatz. By analyzing process access logs and correlating them with Windows Security logs, users can effectively identify suspicious activities indicative of credential theft.
The skill is particularly useful for security operations center (SOC) analysts and incident responders who need to establish robust detection mechanisms for credential dumping techniques. It provides a structured approach to building detection rules and threat hunting queries, enabling teams to proactively hunt for signs of credential theft. The expected output is a comprehensive JSON report that includes detected indicators, severity ratings, and MITRE ATT&CK mappings, which can be directly integrated into existing security information and event management (SIEM) systems like Splunk or Elastic.
To utilize this skill, organizations must ensure that Sysmon is properly configured to log relevant events and that they have the necessary audit policies in place. This includes enabling process creation logging and ensuring that logs are ingested into a SIEM for analysis. By following the outlined steps, users can create effective detection rules for various credential dumping techniques, enhancing their overall security posture against these common attack vectors.
This skill is a valuable addition for any security team looking to improve their incident response capabilities and maintain a strong defense against credential theft on Windows systems. It is essential for those who wish to validate their security monitoring coverage and ensure they are equipped to handle potential credential dumping incidents.
When to use it
Use this skill when investigating potential security incidents involving credential theft or when building detection rules for such activities.
When not to use it
This skill may not be suitable for environments that do not utilize Sysmon or where Windows Security logs are not available for analysis.
What you can build with it
Incident Investigation
Use this skill to investigate security incidents where credential theft is suspected, helping to identify the methods used by attackers.
Detection Rule Creation
Leverage the skill to build effective detection rules for credential dumping techniques, enhancing your security monitoring capabilities.
SOC Analyst Support
Provide structured procedures for SOC analysts to follow when triaging EDR alerts related to LSASS access.
How to install Detecting Credential Dumping Techniques
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/detecting-credential-dumping-techniques --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Detecting Credential Dumping Techniques
Overview
Credential dumping (MITRE ATT&CK T1003) is a post-exploitation technique where adversaries extract authentication credentials from OS memory, registry hives, or domain controller databases. This skill covers detection of LSASS memory access via Sysmon Event ID 10 (ProcessAccess), SAM registry hive export via reg.exe, NTDS.dit extraction via ntdsutil/vssadmin, and comsvcs.dll MiniDump abuse. Detection rules analyze GrantedAccess bitmasks, suspicious calling processes, and known tool signatures.
When to Use
- When investigating security incidents that require detecting credential dumping techniques
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Sysmon v14+ deployed with ProcessAccess logging (Event ID 10) for lsass.exe
- Windows Security audit policy enabling process creation (Event ID 4688) with command line logging
- Splunk or Elastic SIEM ingesting Sysmon and Windows Security logs
- Python 3.8+ for log analysis
Steps
- Configure Sysmon to log ProcessAccess events targeting lsass.exe
- Forward Sysmon Event ID 10 and Windows Event ID 4688 to SIEM
- Create detection rules for known GrantedAccess patterns (0x1010, 0x1FFFFF)
- Detect comsvcs.dll MiniDump and procdump.exe targeting LSASS PID
- Alert on reg.exe SAM/SECURITY/SYSTEM hive export commands
- Detect ntdsutil/vssadmin shadow copy creation for NTDS.dit theft
- Correlate detections with user/host context for risk scoring
Expected Output
JSON report containing detected credential dumping indicators with technique classification, severity ratings, process details, MITRE ATT&CK mapping, and Splunk/Elastic detection queries.
Frequently asked questions about Detecting Credential Dumping Techniques
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.