npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
- When investigating security incidents that require hunting credential stuffing attacks
Detects credential stuffing attacks in auth logs using Python/pandas to analyze IP diversity, login velocity, password sprays, ASN, and geo patterns. For threat hunting and detection rules.
Detects credential stuffing attacks in auth logs via login rate anomalies, ASN/IP diversity, password spray patterns, and failed login geo distributions using Python/pandas on Splunk/raw data. For account takeover hunting.
Detects anomalous authentication patterns in logs using UEBA analytics, statistical baselines, and ML models to identify impossible travel, brute force, credential stuffing, password spraying, and compromised accounts. For security analysis of login behaviors.
Share bugs, ideas, or general feedback.
Analyze authentication logs to detect credential stuffing by identifying patterns of distributed login failures, high IP diversity, and suspicious ASN distribution.
import pandas as pd
from collections import Counter
# Load auth logs
df = pd.read_csv("auth_logs.csv", parse_dates=["timestamp"])
# Credential stuffing indicator: many IPs trying few accounts
ip_per_account = df[df["status"] == "failed"].groupby("username")["source_ip"].nunique()
accounts_under_attack = ip_per_account[ip_per_account > 50]
Key detection indicators:
# Password spray: one password tried across many accounts
spray = df[df["status"] == "failed"].groupby(["source_ip", "password_hash"]).agg(
accounts=("username", "nunique")).reset_index()
sprays = spray[spray["accounts"] > 10]