Detects credential stuffing attacks by analyzing authentication logs for login velocity anomalies, ASN diversity, password spray patterns, and geographic distribution of failed logins. Uses statistical analysis on Splunk or raw log data. Use when investigating account takeover campaigns or building detection rules for auth abuse.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-credential-stuffing-attacksnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-credential-stuffing-attacks -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-credential-stuffing-attacks -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/hunting-credential-stuffing-attacksgh skill install mukul975/Anthropic-Cybersecurity-Skills hunting-credential-stuffing-attacksgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/hunting-credential-stuffing-attacks ~/.claude/skills/hunting-credential-stuffing-attacks # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/hunting-credential-stuffing-attacks ~/.agents/skills/hunting-credential-stuffing-attacks # Codex, Cursor, Gemini CLI, Copilot, OpenCode