Detect OS credential dumping (MITRE T1003) targeting LSASS memory, the SAM database, NTDS.dit, and cached credentials by correlating EDR telemetry, Sysmon process-access events, and Windows security event logs. Use when hunting for Mimikatz-style credential theft, triaging an EDR alert on LSASS access, or scoping an incident after suspected credential dumping.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-t1003-credential-dumping-with-edrnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-t1003-credential-dumping-with-edr -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-t1003-credential-dumping-with-edr -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/detecting-t1003-credential-dumping-with-edrgh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-t1003-credential-dumping-with-edrgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-t1003-credential-dumping-with-edr ~/.claude/skills/detecting-t1003-credential-dumping-with-edr # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-t1003-credential-dumping-with-edr ~/.agents/skills/detecting-t1003-credential-dumping-with-edr # Codex, Cursor, Gemini CLI, Copilot, OpenCode