detecting-service-account-abuse
From the author
Detect abuse of service accounts through anomalous interactive logons, privilege escalation, lateral movement, and unauthorized access patterns.
Install
npx skills add 26zl/cybersec-toolkit --skill detecting-service-account-abuse -a claude-code
Installs to .claude/skills/detecting-service-account-abuse/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
- Ships scripts we have not reviewedLow
Why 77
Security85
Provenance63
Maintenance100
Licence100
Adoption33
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- detecting-insider-threat-behaviors26zl/cybersec-toolkitDetect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated data theft.Other★ 82
- log-analysisjmagly/aiwgCorrelate auth.log, syslog, journald, application, and web logs to detect brute force, privilege escalation, and lateral movement.Other★ 225
- identity-compromisegensecaihq/Wazuh-AutopilotInvestigate suspected account compromise — brute force followed by success, impossible travel, privilege escalation and lateral movement across Linux and Windows; use when a user account appears in suspicious authentication activity.Finance★ 60
- performing-service-account-audit26zl/cybersec-toolkitAudit service accounts across enterprise infrastructure to identify orphaned, over-privileged, and non-compliant accounts. This skill covers discovery of service accounts in Active Directory, cloud plDevOps★ 82
- detecting-azure-lateral-movement26zl/cybersec-toolkitDetect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomaly correlation to identify privilege escalation, token theft, and cross-tenant pivoting.DevOps★ 82
- detecting-shadow-it-cloud-usage26zl/cybersec-toolkitDetect unauthorized SaaS and cloud service usage (shadow IT) by analyzing proxy logs, DNS query logs, and netflow data using Python pandas for traffic pattern analysis and domain classification.Data★ 82
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in