Detect Mimikatz credential-dumping activity via command-line pattern matching, LSASS access signatures, binary/hash indicators, and in-memory detection of known Mimikatz modules. Use when threat hunting for T1003 credential access, triaging EDR/SIEM alerts on LSASS access, scoping compromise during incident response, or validating detection coverage in a purple team exercise.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-mimikatz-execution-patternsnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-mimikatz-execution-patterns -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-mimikatz-execution-patterns -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/detecting-mimikatz-execution-patternsgh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-mimikatz-execution-patternsgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-mimikatz-execution-patterns ~/.claude/skills/detecting-mimikatz-execution-patterns # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-mimikatz-execution-patterns ~/.agents/skills/detecting-mimikatz-execution-patterns # Codex, Cursor, Gemini CLI, Copilot, OpenCode