Skill UI

Provides offensive operators with a full Active Directory attack playbook covering reconnaissance, credential harvesting, Kerberos abuses, lateral movement, privilege escalation, and persistence tools for red team and penetration engagements.

Guides SSH service security assessments from discovery, enumeration, credential attacks and key testing to tunneling, vulnerability exploitation, and reporting deliverables.

Guides testers through simulating an insider or post-breach actor on the corporate LAN to detect lateral movement, privilege escalation, credential capture, and data exposure by combining discovery, credential attacks, and exploitation phases.

Detects DCSync attacks by alerting when non-domain-controller accounts request AD replication GUIDs, correlating DsGetNCChanges traffic, and guiding incident response on credential theft.

Detects credential stuffing attacks by analyzing authentication logs for velocity anomalies, ASN diversity, password spray patterns, and geographic distribution of failed logins; useful when hunting account takeover campaigns or tuning detection rules.

Detect DCSync credential-theft attempts by analyzing Windows Event ID 4662 for unauthorized DS-Replication-Get-Changes requests, correlating with known domain controllers and filtering legitimate replication tools to guide response.

Deploys distributed rate-limiters based on token bucket and sliding window algorithms, with adaptive tightening during attacks, to detect and block API abuse such as DDoS, brute-force, credential stuffing, and scraping while integrating Redis counters and monitoring.

Guides teams through securing serverless compute (AWS Lambda, Azure Functions, Google Cloud Functions) by enforcing least-privilege IAM, replacing hardcoded secrets with managed stores, embedding dependency scanning in CI/CD, validating inputs, and monitoring runtimes to block injections, credential theft, and supply-chain attacks.