Skill UI

This skill provides advanced threat hunting capabilities to detect NTLM relay attacks within Active Directory environments. It analyzes critical Windows Security Event 4624 logs, specifically focusing on logon type 3 using NTLMSSP authentication. The detection logic identifies suspicious patterns, including IP-to-hostname mismatches, rapid multi-host authentications, and lack of SMB signing enforcement, helping SOC analysts pinpoint unauthorized credential access attempts.

This comprehensive playbook details advanced techniques for exploiting Layer 2 and Layer 3 network protocols. It covers attacks such as ARP spoofing, LLMNR/mDNS poisoning, WPAD abuse, DHCPv6 takeover, VLAN hopping, and STP manipulation. Designed for penetration testers, it facilitates MitM positioning, credential harvesting (NTLM relay), and robust network environment exploitation.

This skill details the advanced red-teaming technique of exploiting Active Directory Certificate Services (AD CS) via the ESC8 path. By abusing the HTTP web-enrollment endpoint and relaying coerced NTLM credentials, an attacker can compel a domain controller to request a machine certificate. This certificate is then used to compromise the domain via PKINIT and DCSync.