From asi
Detects Mimikatz execution through command-line patterns, LSASS access signatures, binary indicators, and in-memory detection of known modules.
npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
- When proactively hunting for indicators of detecting mimikatz execution patterns in the environment
Detects Mimikatz execution patterns via command-line args, LSASS access, binaries, and memory modules using EDR, SIEM, Sysmon for threat hunting and incident response.
Detects Mimikatz execution via command line patterns, LSASS access signatures, binary indicators, and known module memory in EDR/SIEM logs. Useful for threat hunting, incident response, and purple team exercises in Windows environments.
Detects Pass-the-Hash attacks by analyzing NTLM authentication patterns, Type 3 logons instead of Kerberos, and correlating with credential dumping in EDR/SIEM logs. For threat hunting and incident response.
Share bugs, ideas, or general feedback.
| Concept | Description |
|---|---|
| T1003.001 | LSASS Memory |
| T1003.006 | DCSync |
| T1558.003 | Kerberoasting |
| T1558.001 | Golden Ticket |
| Tool | Purpose |
|---|---|
| CrowdStrike Falcon | EDR telemetry and threat detection |
| Microsoft Defender for Endpoint | Advanced hunting with KQL |
| Splunk Enterprise | SIEM log analysis with SPL queries |
| Elastic Security | Detection rules and investigation timeline |
| Sysmon | Detailed Windows event monitoring |
| Velociraptor | Endpoint artifact collection and hunting |
| Sigma Rules | Cross-platform detection rule format |
Hunt ID: TH-DETECT-[DATE]-[SEQ]
Technique: T1003.001
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]