[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71DF3FWM2GEPBQZKMY0DDNE":3,"skill-same:01M71DF3FWM2GEPBQZKMY0DDNE":65},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":33,"linkOnly":34,"markdownContent":35,"markdownBody":36,"frontMatter":37,"refName":38,"commitSha":39,"skillDirectory":40,"forksCount":14,"repositoryHtmlUrl":41,"repositoryHomepageUrl":6,"ownerHtmlUrl":42,"ownerBlogUrl":6,"ownerDescription":43,"updatedAt":44,"install":45,"resources":58},"01M71DF3FWM2GEPBQZKMY0DDNE","identity-analytics-anomalous",null,"Identity Analytics Anomalous.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fidentity-analytics-anomalous\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000013","分析与可视化","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[29,30,31,32],"identity","analytics","identity analytics anomalous","cybersecurity","2026-11-10 10:12:30",false,"---\nname: identity-analytics-anomalous\ndescription: \"Identity Analytics Anomalous.\"\ndomain: cybersecurity\n---\n\n|\n| **Impossible Travel** | Authentication anomaly where a user logs in from two geographically distant locations within a timeframe that makes physical travel impossible |\n| **Password Spraying** | Credential attack that tries a small number of commonly used passwords against many accounts to avoid lockout thresholds |\n| **Credential Stuffing** | Automated attack using stolen username\u002Fpassword pairs from data breaches to gain unauthorized access to accounts |\n| **UEBA** | User and Entity Behavior Analytics technology that builds behavioral baselines and detects deviations using machine learning and statistical analysis |\n| **Behavioral Baseline** | Statistical profile of a user's normal authentication patterns including typical hours, locations, devices, and applications |\n| **Isolation Forest** | Unsupervised machine learning algorithm that detects anomalies by isolating observations that differ from the majority of data points |\n| **Risk Score** | Composite numerical value aggregating multiple anomaly signals with weighted scoring to prioritize authentication threats |\n\n## Tools & Systems\n\n- **Microsoft Sentinel UEBA**: Cloud-native SIEM with built-in entity behavior analytics for Azure AD and multi-cloud authentication anomaly detection\n- **Exabeam Advanced Analytics**: UEBA platform using machine learning for user session analysis and automated threat timeline construction\n- **Splunk UBA**: Behavioral analytics add-on for Splunk providing pre-built authentication anomaly models and risk scoring\n- **Elastic SIEM ML Jobs**: Machine learning anomaly detection jobs for authentication log analysis in the Elastic Stack\n\n## Common Scenarios\n\n### Scenario: Detecting Compromised Executive Account After Password Spray\n\n**Context**: SOC observes a spike in failed authentication attempts from a cloud VPS IP address targeting 200+ accounts. Two hours later, an executive account shows successful authentication from the same IP range followed by mailbox rule creation and data exfiltration.\n\n**Approach**:\n1. Run password spray detection across the timeframe to identify all targeted accounts\n2. Cross-reference targeted accounts with subsequent successful logins from related IP ranges\n3. Build behavioral baseline for the executive account and flag all deviations\n4. Check for impossible travel between the executive's last legitimate login and the attacker's session\n5. Identify post-compromise activity: mailbox rules, file downloads, delegated access changes\n6. Calculate composite risk score combining password spray, new IP, off-hours login, and new device signals\n7. Trigger automated response: force session termination, disable account, notify manager\n\n**Pitfalls**:\n- Relying on single-signal detection (failed logins only) misses successful spray results\n- Not correlating across identity providers when users have accounts in multiple IdPs\n- Static thresholds that do not account for legitimate VPN IP changes or travel\n- Ignoring successful authentications after the spray window closes (attackers may wait before using credentials)\n\n## Output Format\n\n```\nAUTHENTICATION ANOMALY DETECTION REPORT\n=========================================\nAnalysis Period:   2026-02-01 to 2026-02-24\nTotal Auth Events: 2,847,392\nUsers Monitored:   3,847\nAlert Sources:     Azure AD, Okta, Windows AD\n\nTHREAT DETECTION SUMMARY\nPassword Spray Attacks:    3\nBrute Force Attacks:       12\nImpossible Travel:         8\nCredential Stuffing:       1\nBehavioral Anomalies:      47\n\nHIGH-RISK ACCOUNTS\n[CRITICAL] j.smith@corp.com     Score: 92\n  - Impossible travel: Chicago -> Moscow (7,876 km in 0.5h)\n  - Password spray target followed by successful login\n  - New device and browser fingerprint\n  - Off-hours access to SharePoint and email\n  Action: Account suspended, SOC investigation initiated\n\n[HIGH] m.johnson@corp.com       Score: 67\n  - Login from new country (Brazil)\n  - New source IP not matching VPN ranges\n  - Access to HR application outside normal pattern\n  Action: MFA re-enrollment required, manager notified\n\n[MEDIUM] a.williams@corp.com    Score: 38\n  - Weekend login at 03:00 UTC\n  - New device (Linux, typically Windows user)\n  Action: Step-up authentication applied\n\nATTACK CAMPAIGN DETAILS\nPassword Spray Campaign #1:\n  Source:            185.220.101.x\u002F24 (Tor exit node)\n  Targeted Users:    247\n  Success Rate:      0.8% (2 accounts compromised)\n  Compromised:       j.smith@corp.com, r.davis@corp.com\n  Duration:          45 minutes\n  Pattern:           2 attempts per user, 3-second interval\n```\n","|\n| **Impossible Travel** | Authentication anomaly where a user logs in from two geographically distant locations within a timeframe that makes physical travel impossible |\n| **Password Spraying** | Credential attack that tries a small number of commonly used passwords against many accounts to avoid lockout thresholds |\n| **Credential Stuffing** | Automated attack using stolen username\u002Fpassword pairs from data breaches to gain unauthorized access to accounts |\n| **UEBA** | User and Entity Behavior Analytics technology that builds behavioral baselines and detects deviations using machine learning and statistical analysis |\n| **Behavioral Baseline** | Statistical profile of a user's normal authentication patterns including typical hours, locations, devices, and applications |\n| **Isolation Forest** | Unsupervised machine learning algorithm that detects anomalies by isolating observations that differ from the majority of data points |\n| **Risk Score** | Composite numerical value aggregating multiple anomaly signals with weighted scoring to prioritize authentication threats |\n\n## Tools & Systems\n\n- **Microsoft Sentinel UEBA**: Cloud-native SIEM with built-in entity behavior analytics for Azure AD and multi-cloud authentication anomaly detection\n- **Exabeam Advanced Analytics**: UEBA platform using machine learning for user session analysis and automated threat timeline construction\n- **Splunk UBA**: Behavioral analytics add-on for Splunk providing pre-built authentication anomaly models and risk scoring\n- **Elastic SIEM ML Jobs**: Machine learning anomaly detection jobs for authentication log analysis in the Elastic Stack\n\n## Common Scenarios\n\n### Scenario: Detecting Compromised Executive Account After Password Spray\n\n**Context**: SOC observes a spike in failed authentication attempts from a cloud VPS IP address targeting 200+ accounts. Two hours later, an executive account shows successful authentication from the same IP range followed by mailbox rule creation and data exfiltration.\n\n**Approach**:\n1. Run password spray detection across the timeframe to identify all targeted accounts\n2. Cross-reference targeted accounts with subsequent successful logins from related IP ranges\n3. Build behavioral baseline for the executive account and flag all deviations\n4. Check for impossible travel between the executive's last legitimate login and the attacker's session\n5. Identify post-compromise activity: mailbox rules, file downloads, delegated access changes\n6. Calculate composite risk score combining password spray, new IP, off-hours login, and new device signals\n7. Trigger automated response: force session termination, disable account, notify manager\n\n**Pitfalls**:\n- Relying on single-signal detection (failed logins only) misses successful spray results\n- Not correlating across identity providers when users have accounts in multiple IdPs\n- Static thresholds that do not account for legitimate VPN IP changes or travel\n- Ignoring successful authentications after the spray window closes (attackers may wait before using credentials)\n\n## Output Format\n\n```\nAUTHENTICATION ANOMALY DETECTION REPORT\n=========================================\nAnalysis Period:   2026-02-01 to 2026-02-24\nTotal Auth Events: 2,847,392\nUsers Monitored:   3,847\nAlert Sources:     Azure AD, Okta, Windows AD\n\nTHREAT DETECTION SUMMARY\nPassword Spray Attacks:    3\nBrute Force Attacks:       12\nImpossible Travel:         8\nCredential Stuffing:       1\nBehavioral Anomalies:      47\n\nHIGH-RISK ACCOUNTS\n[CRITICAL] j.smith@corp.com     Score: 92\n  - Impossible travel: Chicago -> Moscow (7,876 km in 0.5h)\n  - Password spray target followed by successful login\n  - New device and browser fingerprint\n  - Off-hours access to SharePoint and email\n  Action: Account suspended, SOC investigation initiated\n\n[HIGH] m.johnson@corp.com       Score: 67\n  - Login from new country (Brazil)\n  - New source IP not matching VPN ranges\n  - Access to HR application outside normal pattern\n  Action: MFA re-enrollment required, manager notified\n\n[MEDIUM] a.williams@corp.com    Score: 38\n  - Weekend login at 03:00 UTC\n  - New device (Linux, typically Windows user)\n  Action: Step-up authentication applied\n\nATTACK CAMPAIGN DETAILS\nPassword Spray Campaign #1:\n  Source:            185.220.101.x\u002F24 (Tor exit node)\n  Targeted Users:    247\n  Success Rate:      0.8% (2 accounts compromised)\n  Compromised:       j.smith@corp.com, r.davis@corp.com\n  Duration:          45 minutes\n  Pattern:           2 attempts per user, 3-second interval\n```\n",{"name":5,"domain":32,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fidentity-analytics-anomalous","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":46,"prompt":56,"zipAvailable":57},[47,50,53],{"tool":48,"command":49},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill identity-analytics-anomalous",{"tool":51,"command":52},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill identity-analytics-anomalous",{"tool":54,"command":55},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill identity-analytics-anomalous","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fidentity-analytics-anomalous\u002FSKILL.md",true,[59],{"path":60,"resourceType":61,"resourceTypeDesc":62,"sizeBytes":63,"sourceHtmlUrl":64},"index.json","REFERENCE","参考文档",512,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fidentity-analytics-anomalous\u002Findex.json",[66,91,114,136,158,174],{"skillNo":67,"name":68,"nameZh":6,"description":69,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":70,"categories":71,"keywords":72,"publishedAt":33},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,32,90],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":97,"publishedAt":33},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[98,73,99,76,100,101,102,32,103,104,105,106,107,108,78,109,110,111,112,113],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":120,"publishedAt":33},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[121,122,123,124,125,126,32,103,127,104,128,129,78,111,130,131,132,133,134,135],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":142,"publishedAt":33},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[74,143,144,145,146,147,148,79,149,32,90,150,151,152,153,154,155,156,157,78],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":164,"publishedAt":33},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[165,166,74,167,145,147,168,79,169,149,32,90,104,170,171,172,173,157,78,80],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":175,"name":176,"nameZh":6,"description":177,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":178,"categories":179,"keywords":180,"publishedAt":33},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[181,74,145,182,168,79,183,184,32,90,185,186,187,188,189,190,78,80,191,192],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]