agentsclimarketplace

Hunting anomalous authentication patterns

Skill meltedinhex/analyst-ai-pack/skills/hunting-anomalous-authentication-patterns

An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill hunting-anomalous-authentication-patterns

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Hunts for anomalous authentication such as password spraying, brute force, and impossible-travel logons by aggregating Windows logon success/failure events per account and source over time. Activates for requests to hunt anomalous logons, detect password spraying or brute force, or find suspicious authentication patterns.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.8 KB, as published. Nobody here has run it

Hunting Anomalous Authentication Patterns

When to Use

  • You have Windows logon success (4624) and failure (4625) events and want to detect password spraying (one password across many accounts), brute force (many failures per account), and suspicious source concentration.
  • You are investigating credential-access attempts against accounts.

Do not use this for a single failed logon — it relies on aggregation across accounts/sources to find patterns, not individual events.

Prerequisites

  • Logon events with account, source IP/host, status, and timestamp.

Workflow

Step 1: Aggregate auth outcomes

python scripts/analyst.py hunt logons.csv

Computes failures per account, distinct accounts targeted per source (spray signal), and failure→success transitions per account (possible compromise).

Step 2: Surface patterns

  • Spray: one source failing against many distinct accounts.
  • Brute force: many failures against one account from a source.
  • Breakthrough: a burst of failures followed by a success.

Step 3: Confirm

Correlate sources with known infrastructure; check whether successes are legitimate.

Step 4: Operationalize

Set thresholds and write a detection (e.g., source touching ≥ N accounts within a window).

Validation

  • Spray detection keys on distinct-account breadth per source, not raw failure count.
  • Brute force keys on per-account failure concentration.
  • Failure-then-success transitions are reported for follow-up.

Pitfalls

  • Service accounts/misconfigured apps generating benign failure storms.
  • NAT/proxy collapsing many users behind one source IP, mimicking spray.
  • Time-window choice: too wide hides bursts, too narrow misses slow sprays.

References

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.