npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
- When proactively hunting for indicators of detecting email forwarding rules attack in the environment
Detects malicious email forwarding rules (T1114.003) for persistence and BEC attacks using EDR, SIEM queries, Sysmon in threat hunting and incident response.
Detects malicious email forwarding rules created by attackers for persistent email access in intelligence collection and BEC attacks. Useful for threat hunting, incident response, and security assessments in EDR/SIEM environments.
Hunts spearphishing indicators across email logs, endpoint telemetry, and network data using SIEM/EDR tools like Splunk, CrowdStrike, and Elastic to detect targeted attacks.
Share bugs, ideas, or general feedback.
| Concept | Description |
|---|---|
| T1114.003 | Email Forwarding Rule |
| T1114.002 | Remote Email Collection |
| T1098.002 | Additional Email Delegate Permissions |
| Tool | Purpose |
|---|---|
| CrowdStrike Falcon | EDR telemetry and threat detection |
| Microsoft Defender for Endpoint | Advanced hunting with KQL |
| Splunk Enterprise | SIEM log analysis with SPL queries |
| Elastic Security | Detection rules and investigation timeline |
| Sysmon | Detailed Windows event monitoring |
| Velociraptor | Endpoint artifact collection and hunting |
| Sigma Rules | Cross-platform detection rule format |
Hunt ID: TH-DETECT-[DATE]-[SEQ]
Technique: T1114.003
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]