Skill UI

A comprehensive guide and analysis framework for detecting compromised Office 365 or Google Workspace email accounts. It focuses on analyzing unified audit logs and Azure AD sign-in logs to identify indicators of account takeover (ATO) or Business Email Compromise (BEC). Detection methods include monitoring impossible travel events, identifying malicious inbox rules (e.g., external forwarding or deletion rules), and analyzing suspicious Microsoft Graph API access patterns.

A comprehensive guide for conducting memory forensics to extract cached credentials, password hashes, Kerberos tickets, and authentication tokens from Windows memory dumps (LSASS). This technique is crucial during incident response or breach assessment to identify compromised accounts or investigate lateral movement.

This technique abuses the Active Directory's `msDS-KeyCredentialLink` attribute to inject attacker-controlled public keys (Shadow Credentials). After gaining write access (e.g., via BloodHound), the attacker uses tools like pyWhisker or Certipy to append their key. They then authenticate via PKINIT to recover the target's NT hash, achieving complete account takeover without the disruptive step of a password reset. Ideal for stealthy red-teaming engagements.