From asi
Hunts Volume Shadow Copy deletions via vssadmin, wmic, PowerShell indicating ransomware preparation or anti-forensics. For threat hunting and incident response.
npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
- When proactively hunting for indicators of hunting for shadow copy deletion in the environment
Hunts shadow copy deletions indicating ransomware or anti-forensics by monitoring vssadmin, wmic, PowerShell in EDR/SIEM logs like CrowdStrike, Splunk, Sysmon.
Hunts shadow copy deletions via vssadmin, wmic, and PowerShell commands signaling ransomware preparation or anti-forensics. Useful for threat hunting in EDR/SIEM environments.
Hunts for adversary persistence via Windows Scheduled Tasks by analyzing creation events, suspicious actions, and unusual patterns. For threat hunting, IR, and security assessments.
Share bugs, ideas, or general feedback.
| Concept | Description |
|---|---|
| T1490 | Inhibit System Recovery |
| T1486 | Data Encrypted for Impact |
| T1485 | Data Destruction |
| Tool | Purpose |
|---|---|
| CrowdStrike Falcon | EDR telemetry and threat detection |
| Microsoft Defender for Endpoint | Advanced hunting with KQL |
| Splunk Enterprise | SIEM log analysis with SPL queries |
| Elastic Security | Detection rules and investigation timeline |
| Sysmon | Detailed Windows event monitoring |
| Velociraptor | Endpoint artifact collection and hunting |
| Sigma Rules | Cross-platform detection rule format |
Hunt ID: TH-HUNTIN-[DATE]-[SEQ]
Technique: T1490
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]