The Agent Skills Directory

[SAFE]: The skill is a defensive security toolkit. The primary components are two Python scripts (agent.py and process.py) that perform regex-based detection of Mimikatz command-line patterns and LSASS access signatures within Windows event logs (EVTX, JSON, and CSV formats). The scripts do not perform any network operations, lack persistence mechanisms, and do not attempt to escalate privileges. The use of the well-known python-evtx library for log parsing is consistent with the skill's stated purpose. The metadata and instructional content are aligned with standard cybersecurity threat hunting workflows.

detecting-mimikatz-execution-patterns