detecting-t1003-credential-dumping-with-edr
mukul975/Anthropic-Cybersecurity-Skills
Detects credential dumping T1003 activity by correlating EDR telemetry, Sysmon process access, and Windows security events to flag suspicious LSASS, SAM, NTDS, and cached credential access, guiding SOCs through containment and lateral movement analysis.