agentsclimarketplace
Sign in

Hunting anomalous authentication patterns

Skill meltedinhex/analyst-ai-pack/skills/hunting-anomalous-authentication-patterns

Hunts for anomalous authentication such as password spraying, brute force, and impossible-travel logons by aggregating Windows logon success/failure events per account and source over time. Activates for requests to hunt anomalous logons, detect password spraying or brute force, or find suspicious authentication patterns.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill hunting-anomalous-authentication-patterns

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 21 stars21 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.8 KB, 406 tokens by cl100k_base, as published. Nobody here has run it

Hunting Anomalous Authentication Patterns

When to Use

  • You have Windows logon success (4624) and failure (4625) events and want to detect password spraying (one password across many accounts), brute force (many failures per account), and suspicious source concentration.
  • You are investigating credential-access attempts against accounts.

Do not use this for a single failed logon — it relies on aggregation across accounts/sources to find patterns, not individual events.

Prerequisites

  • Logon events with account, source IP/host, status, and timestamp.

Workflow

Step 1: Aggregate auth outcomes

python scripts/analyst.py hunt logons.csv

Computes failures per account, distinct accounts targeted per source (spray signal), and failure→success transitions per account (possible compromise).

Step 2: Surface patterns

  • Spray: one source failing against many distinct accounts.
  • Brute force: many failures against one account from a source.
  • Breakthrough: a burst of failures followed by a success.

Step 3: Confirm

Correlate sources with known infrastructure; check whether successes are legitimate.

Step 4: Operationalize

Set thresholds and write a detection (e.g., source touching ≥ N accounts within a window).

Validation

  • Spray detection keys on distinct-account breadth per source, not raw failure count.
  • Brute force keys on per-account failure concentration.
  • Failure-then-success transitions are reported for follow-up.

Pitfalls

  • Service accounts/misconfigured apps generating benign failure storms.
  • NAT/proxy collapsing many users behind one source IP, mimicking spray.
  • Time-window choice: too wide hides bursts, too narrow misses slow sprays.

References

What ships with it: 3 files

5.1 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.