[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6HNFMBKGVFSXA23BA3R4CA2":3,"skill-same:01M6HNFMBKGVFSXA23BA3R4CA2":118},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":61,"commitSha":62,"skillDirectory":63,"forksCount":64,"repositoryHtmlUrl":65,"repositoryHomepageUrl":6,"ownerHtmlUrl":66,"ownerBlogUrl":6,"ownerDescription":67,"updatedAt":68,"install":69,"resources":82},"01M6HNFMBKGVFSXA23BA3R4CA2","performing-service-account-audit",null,"Audit service accounts across enterprise infrastructure to identify orphaned, over-privileged, and non-compliant accounts. This skill covers discovery of service accounts in Active Directory, cloud pl","HenriqueMC17\u002Fagente-core","HenriqueMC17","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206460478?v=4","01M6HB63HBBF18AC4H09XTB549","Henrique Monteiro Cardoso","01M6HB63NGSQXWKWCFWW2B20W0",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-service-account-audit\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"performing","service","audit","performing service account audit","t1078","control","across","active","access","discovery","t1098","directory","service-account","service-accounts","iam","Enterprise","cloud","pr","governance","cybersecurity","2026-11-10 10:12:30",false,"---\nname: performing-service-account-audit\ndescription: Audit service accounts across enterprise infrastructure to identify orphaned, over-privileged, and non-compliant accounts. This skill covers discovery of service accounts in Active Directory, cloud pl\ndomain: cybersecurity\nsubdomain: identity-access-management\ntags:\n- iam\n- identity\n- access-control\n- service-accounts\n- audit\n- governance\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-01\n- PR.AA-02\n- PR.AA-05\n- PR.AA-06\nmitre_attack:\n- T1078\n- T1110\n- T1556\n- T1098\n- T1069\ncategory: performing-service-account-audit\n---\n# Performing Service Account Audit\n\n## Overview\nAudit service accounts across enterprise infrastructure to identify orphaned, over-privileged, and non-compliant accounts. This skill covers discovery of service accounts in Active Directory, cloud platforms, databases, and applications, assessing privilege levels, identifying missing owners, and enforcing lifecycle policies.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing service account audit\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Familiarity with identity access management concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Objectives\n- Discover all service accounts across AD, cloud, databases, and applications\n- Identify orphaned accounts with no valid owner or associated application\n- Assess privilege levels and flag over-privileged service accounts\n- Check for non-rotating passwords and weak authentication\n- Map service account dependencies for safe remediation\n- Generate compliance reports for SOX, PCI DSS, and HIPAA audits\n\n## Key Concepts\n\n### Service Account Types\n1. **AD Service Accounts**: Windows services, scheduled tasks, IIS app pools\n2. **Managed Service Accounts (gMSA)**: AD-managed automatic password rotation\n3. **Cloud IAM Service Accounts**: AWS IAM roles\u002Fusers, Azure service principals, GCP service accounts\n4. **Database Service Accounts**: Application connection accounts, replication accounts\n5. **Application Service Accounts**: API keys, bot accounts, integration accounts\n\n### Audit Dimensions\n- **Ownership**: Who is responsible for this account?\n- **Purpose**: What application\u002Fservice uses this account?\n- **Privileges**: What permissions does this account have?\n- **Authentication**: How does this account authenticate (password, key, certificate)?\n- **Rotation**: When was the credential last changed?\n- **Activity**: When was this account last used?\n\n## Workflow\n\n### Step 1: Discovery - Active Directory\n1. Query AD for all service accounts (filter by description, OU, naming convention)\n2. Identify accounts with `ServicePrincipalName` set\n3. List accounts in privileged groups (Domain Admins, Enterprise Admins)\n4. Check for gMSA vs traditional service accounts\n5. Identify accounts with `PasswordNeverExpires` flag\n\n### Step 2: Discovery - Cloud Platforms\n- **AWS**: List IAM users with access keys, check last used date, identify unused roles\n- **Azure**: Enumerate service principals, app registrations, managed identities\n- **GCP**: List service accounts, check key age, identify unused permissions\n\n### Step 3: Assessment\n- Flag accounts with admin\u002Fprivileged group membership\n- Check password age against rotation policy (90 days max)\n- Identify accounts with no login activity in 90+ days\n- Verify account ownership against CMDB\u002Fasset inventory\n- Check for shared credentials (same password hash across accounts)\n\n### Step 4: Risk Classification\n- **Critical**: Domain\u002Fcloud admin privileges, no password rotation\n- **High**: Access to sensitive data, no identified owner\n- **Medium**: Standard service permissions, password older than 90 days\n- **Low**: Read-only access, managed credentials (gMSA, managed identity)\n\n### Step 5: Remediation\n- Disable orphaned accounts after validation with application teams\n- Convert traditional service accounts to gMSA where possible\n- Rotate credentials older than policy threshold\n- Reduce privileges to minimum required\n- Assign owners and document dependencies\n\n## Security Controls\n| Control | NIST 800-53 | Description |\n|---------|-------------|-------------|\n| Account Management | AC-2 | Service account lifecycle |\n| Account Review | AC-2(3) | Periodic review of accounts |\n| Least Privilege | AC-6 | Minimum service account permissions |\n| Authenticator Management | IA-5 | Service credential rotation |\n| Audit Review | AU-6 | Review service account activity |\n\n## Common Pitfalls\n- Disabling service accounts without verifying application dependencies first\n- Not discovering service accounts outside of Active Directory\n- Missing cloud service principals and managed identities\n- Not checking for interactive logon rights on service accounts\n- Failing to document dependencies before remediation\n\n## Verification\n- [ ] Service accounts inventoried across all platforms\n- [ ] Each account has assigned owner\n- [ ] Privileged service accounts documented with justification\n- [ ] Password rotation compliance checked\n- [ ] Orphaned accounts flagged for remediation\n- [ ] gMSA migration candidates identified\n- [ ] Compliance report generated\n","# Performing Service Account Audit\n\n## Overview\nAudit service accounts across enterprise infrastructure to identify orphaned, over-privileged, and non-compliant accounts. This skill covers discovery of service accounts in Active Directory, cloud platforms, databases, and applications, assessing privilege levels, identifying missing owners, and enforcing lifecycle policies.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing service account audit\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Familiarity with identity access management concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Objectives\n- Discover all service accounts across AD, cloud, databases, and applications\n- Identify orphaned accounts with no valid owner or associated application\n- Assess privilege levels and flag over-privileged service accounts\n- Check for non-rotating passwords and weak authentication\n- Map service account dependencies for safe remediation\n- Generate compliance reports for SOX, PCI DSS, and HIPAA audits\n\n## Key Concepts\n\n### Service Account Types\n1. **AD Service Accounts**: Windows services, scheduled tasks, IIS app pools\n2. **Managed Service Accounts (gMSA)**: AD-managed automatic password rotation\n3. **Cloud IAM Service Accounts**: AWS IAM roles\u002Fusers, Azure service principals, GCP service accounts\n4. **Database Service Accounts**: Application connection accounts, replication accounts\n5. **Application Service Accounts**: API keys, bot accounts, integration accounts\n\n### Audit Dimensions\n- **Ownership**: Who is responsible for this account?\n- **Purpose**: What application\u002Fservice uses this account?\n- **Privileges**: What permissions does this account have?\n- **Authentication**: How does this account authenticate (password, key, certificate)?\n- **Rotation**: When was the credential last changed?\n- **Activity**: When was this account last used?\n\n## Workflow\n\n### Step 1: Discovery - Active Directory\n1. Query AD for all service accounts (filter by description, OU, naming convention)\n2. Identify accounts with `ServicePrincipalName` set\n3. List accounts in privileged groups (Domain Admins, Enterprise Admins)\n4. Check for gMSA vs traditional service accounts\n5. Identify accounts with `PasswordNeverExpires` flag\n\n### Step 2: Discovery - Cloud Platforms\n- **AWS**: List IAM users with access keys, check last used date, identify unused roles\n- **Azure**: Enumerate service principals, app registrations, managed identities\n- **GCP**: List service accounts, check key age, identify unused permissions\n\n### Step 3: Assessment\n- Flag accounts with admin\u002Fprivileged group membership\n- Check password age against rotation policy (90 days max)\n- Identify accounts with no login activity in 90+ days\n- Verify account ownership against CMDB\u002Fasset inventory\n- Check for shared credentials (same password hash across accounts)\n\n### Step 4: Risk Classification\n- **Critical**: Domain\u002Fcloud admin privileges, no password rotation\n- **High**: Access to sensitive data, no identified owner\n- **Medium**: Standard service permissions, password older than 90 days\n- **Low**: Read-only access, managed credentials (gMSA, managed identity)\n\n### Step 5: Remediation\n- Disable orphaned accounts after validation with application teams\n- Convert traditional service accounts to gMSA where possible\n- Rotate credentials older than policy threshold\n- Reduce privileges to minimum required\n- Assign owners and document dependencies\n\n## Security Controls\n| Control | NIST 800-53 | Description |\n|---------|-------------|-------------|\n| Account Management | AC-2 | Service account lifecycle |\n| Account Review | AC-2(3) | Periodic review of accounts |\n| Least Privilege | AC-6 | Minimum service account permissions |\n| Authenticator Management | IA-5 | Service credential rotation |\n| Audit Review | AU-6 | Review service account activity |\n\n## Common Pitfalls\n- Disabling service accounts without verifying application dependencies first\n- Not discovering service accounts outside of Active Directory\n- Missing cloud service principals and managed identities\n- Not checking for interactive logon rights on service accounts\n- Failing to document dependencies before remediation\n\n## Verification\n- [ ] Service accounts inventoried across all platforms\n- [ ] Each account has assigned owner\n- [ ] Privileged service accounts documented with justification\n- [ ] Password rotation compliance checked\n- [ ] Orphaned accounts flagged for remediation\n- [ ] gMSA migration candidates identified\n- [ ] Compliance report generated\n",{"name":5,"tags":44,"author":47,"domain":38,"license":15,"version":48,"category":5,"nist_csf":49,"subdomain":54,"description":7,"mitre_attack":55},[33,45,46,32,21,37],"identity","access-control","mahipal","1.0",[50,51,52,53],"PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06","identity-access-management",[56,57,58,59,60],"T1078","T1110","T1556","T1098","T1069","main","5eea5b3296f4673b5f481e8bcc1ba76281149f16","modules\u002Fperforming-service-account-audit",0,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core","https:\u002F\u002Fgithub.com\u002FHenriqueMC17","Qualquer tecnologia suficientemente avançada é indistinguível da mágica.","2026-09-28 22:40:38",{"source":8,"skillName":5,"commands":70,"prompt":80,"zipAvailable":81},[71,74,77],{"tool":72,"command":73},"npx","npx skills add HenriqueMC17\u002Fagente-core --skill performing-service-account-audit",{"tool":75,"command":76},"bunx","bunx skills add HenriqueMC17\u002Fagente-core --skill performing-service-account-audit",{"tool":78,"command":79},"pnpm","pnpm dlx skills add HenriqueMC17\u002Fagente-core --skill performing-service-account-audit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-service-account-audit\u002FSKILL.md",true,[83,89,94,100,104,108,114],{"path":84,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"assets\u002Ftemplate.md","ASSET","资产文件",926,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-service-account-audit\u002Fassets\u002Ftemplate.md",{"path":90,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-service-account-audit\u002FLICENSE",{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"references\u002Fapi-reference.md","REFERENCE","参考文档",2296,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-service-account-audit\u002Freferences\u002Fapi-reference.md",{"path":101,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":102,"sourceHtmlUrl":103},"references\u002Fstandards.md",885,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-service-account-audit\u002Freferences\u002Fstandards.md",{"path":105,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":106,"sourceHtmlUrl":107},"references\u002Fworkflows.md",989,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-service-account-audit\u002Freferences\u002Fworkflows.md",{"path":109,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":112,"sourceHtmlUrl":113},"scripts\u002Fagent.py","SCRIPT","脚本",6890,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-service-account-audit\u002Fscripts\u002Fagent.py",{"path":115,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":116,"sourceHtmlUrl":117},"scripts\u002Fprocess.py",11739,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-service-account-audit\u002Fscripts\u002Fprocess.py",[119,149,175,198,214,235],{"skillNo":120,"name":121,"nameZh":6,"description":122,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":123,"categories":124,"keywords":130,"publishedAt":39},"01M6HPFF0RCN0X6WT5EBSV71GY","validating-backup-integrity-for-recovery","Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[125],{"categoryNo":126,"categoryName":127,"taxonomyType":128,"taxonomyTypeDesc":129},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[131,132,133,134,135,136,38,137,138,139,140,141,142,23,143,144,145,146,147,148],"integrity","backup","recovery","validating backup integrity for recovery","for","testing","validate","verification","hash-verification","incident-response","ransomware","detection","t1490","disaster-recovery","restore","incident","disaster recovery","ransomware response",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":155,"publishedAt":39},"01M6HPFAWJVFK25Q33K3T7WQ8G","triaging-vulnerabilities-with-ssvc-framework","Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[],[156,157,158,159,160,38,161,162,163,164,165,166,167,168,169,170,171,172,173,174],"vulnerabilities","framework","ssvc","triaging vulnerabilities with ssvc framework","with","triage and prioritize","CISA","vulnerability-management","risk-management","cvss","remediation","vulnerability","prioritization","decision-tree","prioritize","decision","priorities","actionable","tree",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":181,"publishedAt":39},"01M6HPF6JS9X72WP59094H3ASQ","triaging-security-incident","Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002FSKILL.md",[],[182,183,146,38,184,185,186,23,143,187,188,189,190,191,192,193,194,195,196,197],"security","triaging security incident","actions","soc","NIST","analysis","severity-classification","incident-triage","SANS-PICERL","SOC-operations","picerl","conversion","isolation","scope","impact","consistency",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":204,"publishedAt":39},"01M6HPF2EX6ZYNYYHKBRJN7GEF","triaging-security-incident-with-ir-playbook","Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[],[182,205,206,183,146,160,38,207,185,140,208,209,23,143,210,188,170,211,212,213],"playbook","triaging security incident with ir playbook","teams","IR-playbook","severity","classification","classify","incidents","initiate",{"skillNo":215,"name":216,"nameZh":6,"description":217,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":218,"categories":219,"keywords":220,"publishedAt":39},"01M6HPEY9XPGE7X95AG4XJFQAW","triaging-security-alerts-in-splunk","Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-alerts-in-splunk\u002FSKILL.md",[],[182,221,222,223,224,225,38,226,227,228,185,229,23,230,231,232,191,233,146,234],"security alerts","splunk","triaging security alerts in splunk","alerts","review","siem","dashboard","search","correlation-search","t1566","notable-events","incident-review","cm","de",{"skillNo":236,"name":237,"nameZh":6,"description":238,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":239,"categories":240,"keywords":241,"publishedAt":39},"01M6HPET6XGEPEJPN7V032JGZ0","tracking-threat-actor-infrastructure","Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftracking-threat-actor-infrastructure\u002FSKILL.md",[],[242,243,244,245,38,246,247,248,249,250,251,230,252,253,233,254,234,255,256,257],"infrastructure","tracking threat actor infrastructure","tracking","threat","monitoring","mitre-attack","threat-actor","threat-intelligence","command-and-control","dns","command","exploit","intelligence","domains","kit","hosts"]