SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
hunting-anomalous-authentication-patterns
0
Hunts for anomalous authentication such as password spraying, brute force, and impossible-travel logons by aggregating Windows logon success/failure events per account and source over time. Activates for requests to hunt anomalous logons, detect password spraying or brute force, or find suspicious authentication patterns.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Hunting Anomalous Authentication Patterns ## When to Use - You have Windows logon success (4624) and failure (4625) events and want to detect password spraying (one password across many accounts), brute force (many failures per account), and suspicious source concentration. - You are investigating credential-access attempts against accounts. **Do not use** this for a single failed logon — it relies on aggregation across accounts/sources to find patterns, not individual events. ## Prerequisites - Logon events with account, source IP/host, status, and timestamp. ## Workflow ### Step 1: Aggregate auth outcomes ```bash python scripts/analyst.py hunt logons.csv ``` Computes failures per account, distinct accounts targeted per source (spray signal), and failure→success transitions per account (possible compromise). ### Step 2: Surface patterns - Spray: one source failing against many distinct accounts. - Brute force: many failures against one account from a source. - Breakthrough: a burst of failures followed by a success. ### Step 3: Confirm Correlate sources with known infrastructure; check whether successes are legitimate. ### Step 4: Operationalize Set thresholds and write a detection (e.g., source touching ≥ N accounts within a window). ## Validation - Spray detection keys on distinct-account breadth per source, not raw failure count. - Brute force keys on per-account failure concentration. - Failure-then-success transitions are reported for follow-up. ## Pitfalls - Service accounts/misconfigured apps generating benign failure storms. - NAT/proxy collapsing many users behind one source IP, mimicking spray. - Time-window choice: too wide hides bursts, too narrow misses slow sprays. ## References - See [`references/api-reference.md`](references/api-reference.md) for the hunter. - ATT&CK T1110.003 and Event 4625/4624 docs (linked in frontmatter).