Detecting Service Account Abuse
FreeProactively hunt for service account misuse.
Free · Opens the source repo
What Detecting Service Account Abuse does
Detecting Service Account Abuse is a specialized skill designed for cybersecurity professionals focused on identifying and mitigating the risks associated with service account misuse. Service accounts are often targeted by threat actors for privilege escalation and lateral movement, making it crucial to monitor their activity closely. This skill leverages EDR and SIEM telemetry from platforms like CrowdStrike Falcon, Microsoft Defender, and Splunk to detect anomalous interactive logons and other suspicious behaviors. By utilizing Sigma detection rules, it helps in formulating a proactive defense against potential threats.
The workflow begins with formulating a hypothesis based on threat intelligence or gaps identified in the MITRE ATT&CK framework. Security analysts can then identify relevant data sources, execute queries against their SIEM and EDR platforms, and analyze the results for anomalies. This structured approach not only aids in identifying true positives but also helps in correlating activities with broader attack patterns. The documentation and reporting phase ensures that findings are recorded, detection rules are updated, and appropriate response actions are recommended.
This skill is particularly beneficial during incident response scenarios, proactive threat hunting, and regular security assessments. It provides a comprehensive framework for understanding the tactics, techniques, and procedures (TTPs) used by threat actors, specifically focusing on service accounts. By integrating with existing security tools and processes, it enhances the overall security posture of an organization and enables teams to respond effectively to potential threats.
When to use it
Use this skill when actively hunting for service account misuse or investigating unexpected interactive logons during incident response.
When not to use it
This skill may not be suitable for environments without the necessary EDR or SIEM tools, or for teams lacking threat intelligence integration.
What you can build with it
Investigating Suspicious Logons
Use this skill to analyze unexpected interactive logons from service accounts, helping to identify potential breaches.
Proactive Threat Hunting
Employ this skill during proactive threat hunting exercises to uncover indicators of service account misuse.
Incident Response Scoping
Utilize this skill to scope incidents involving service accounts, ensuring a thorough investigation of potential compromises.
How to install Detecting Service Account Abuse
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/detecting-service-account-abuse --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Detecting Service Account Abuse
When to Use
- When proactively hunting for indicators of detecting service account abuse in the environment
- After threat intelligence indicates active campaigns using these techniques
- During incident response to scope compromise related to these techniques
- When EDR or SIEM alerts trigger on related indicators
- During periodic security assessments and purple team exercises
Prerequisites
- EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)
- SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)
- Sysmon deployed with comprehensive configuration
- Windows Security Event Log forwarding enabled
- Threat intelligence feeds for IOC correlation
Workflow
- Formulate Hypothesis: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.
- Identify Data Sources: Determine which logs and telemetry are needed to validate or refute the hypothesis.
- Execute Queries: Run detection queries against SIEM and EDR platforms to collect relevant events.
- Analyze Results: Examine query results for anomalies, correlating across multiple data sources.
- Validate Findings: Distinguish true positives from false positives through contextual analysis.
- Correlate Activity: Link findings to broader attack chains and threat actor TTPs.
- Document and Report: Record findings, update detection rules, and recommend response actions.
Key Concepts
| Concept | Description |
|---|---|
| T1078.002 | Domain Accounts |
| T1078.001 | Default Accounts |
| T1021 | Remote Services |
Tools & Systems
| Tool | Purpose |
|---|---|
| CrowdStrike Falcon | EDR telemetry and threat detection |
| Microsoft Defender for Endpoint | Advanced hunting with KQL |
| Splunk Enterprise | SIEM log analysis with SPL queries |
| Elastic Security | Detection rules and investigation timeline |
| Sysmon | Detailed Windows event monitoring |
| Velociraptor | Endpoint artifact collection and hunting |
| Sigma Rules | Cross-platform detection rule format |
Common Scenarios
- Scenario 1: Service account RDP to domain controller
- Scenario 2: SQL service accessing file shares outside scope
- Scenario 3: Backup service lateral movement off-hours
- Scenario 4: Compromised svc with DA privileges used for DCSync
Output Format
Hunt ID: TH-DETECT-[DATE]-[SEQ]
Technique: T1078.002
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]
Frequently asked questions about Detecting Service Account Abuse
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.