detecting-pass-the-hash-attacks
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides legitimate threat hunting logic for detecting Pass-the-Hash attacks using security telemetry.
- [EXTERNAL_DOWNLOADS]: The script
scripts/agent.pymentionspython-evtxas a dependency for parsing Windows Event Log (EVTX) files. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data sources including Windows event logs and structured files.
- Ingestion points: Log parsing functions in
scripts/agent.pyandscripts/process.pyread data from user-specified file paths. - Boundary markers: The skill uses structured parsing and specific event filters (e.g., EventID 4624) to isolate data.
- Capability inventory: The skill's capabilities are restricted to event correlation and local logging (stdout or local file write). It lacks network access or shell command execution features.
- Sanitization: Log data is treated as literal values for comparison and reporting, not as executable commands.
Audit Metadata