Skill UI

This guide details the deployment of Cisco Identity Services Engine (ISE) for comprehensive Network Access Control (NAC). It utilizes 802.1X authentication, MAC Authentication Bypass (MAB), and posture assessment to enforce security policies. Key features include integrating with Active Directory, assigning dynamic VLANs, and applying TrustSec Security Group Tags (SGTs) for advanced network segmentation in enterprise environments.

A comprehensive guide for incident responders detailing how to investigate Active Directory (AD) compromises. This skill covers analyzing critical components like NTDS.dit integrity, detecting Kerberos anomalies (Golden/Silver Tickets), tracing lateral movement, and identifying Group Policy abuse to reconstruct attacker activity and determine the full scope of a breach.

This skill guides comprehensive Active Directory (AD) security assessment using industry-standard tools like PingCastle, BloodHound, and Purple Knight. It helps identify critical misconfigurations, excessive privileges, weak Kerberos settings, and potential lateral movement paths. Ideal for penetration testing, security audits, and incident response to proactively secure enterprise identity management systems.

A comprehensive skill for auditing service accounts across complex enterprise environments, including Active Directory, major cloud platforms (AWS, Azure, GCP), and databases. It identifies risks such as orphaned accounts, over-privileged access, and non-compliant credentials, ensuring adherence to industry standards like SOX, PCI DSS, and HIPAA. Used during security assessments and compliance reviews.

A comprehensive, NIST/CISA-aligned workflow for structured recovery following a ransomware incident. It covers critical steps including environment isolation, forensic evidence preservation, Active Directory restoration (DSRM, krbtgt reset), backup integrity validation, and phased, dependency-based system rebuild. Essential for post-incident disaster recovery planning.

A comprehensive guide to hardening Windows Active Directory environments using Group Policy Objects (GPO). This skill configures multiple layers of defense, including AppLocker, Controlled Folder Access, and Attack Surface Reduction (ASR) rules, to prevent ransomware execution paths, block unauthorized file modifications, and restrict lateral movement across the domain.

This guide details how to establish SAML 2.0 identity federation between on-premises Active Directory (using AD FS or third-party IdP) and Microsoft Entra ID. It covers hybrid identity architectures, configuring federation models (AD FS, PHS, PTA), and implementing the full SAML authentication flow. Essential for extending on-premises authentication authority to cloud resources and maintaining security compliance.

This technique abuses the Active Directory's `msDS-KeyCredentialLink` attribute to inject attacker-controlled public keys (Shadow Credentials). After gaining write access (e.g., via BloodHound), the attacker uses tools like pyWhisker or Certipy to append their key. They then authenticate via PKINIT to recover the target's NT hash, achieving complete account takeover without the disruptive step of a password reset. Ideal for stealthy red-teaming engagements.

NetExec is a comprehensive, multi-protocol tool designed for authorized penetration testing and red-teaming. It functions as a 'swiss-army knife' for assessing Windows, Active Directory, and Linux environments. Key capabilities include validating credentials, performing password spraying, enumerating network shares, executing commands across multiple protocols (SMB, WinRM, LDAP, MSSQL, SSH), and dumping critical credentials (SAM, LSA, NTDS). It directly supports techniques for lateral movement and post-exploitation activities.

This technique exploits vulnerable Active Directory Certificate Services (AD CS) HTTP web-enrollment endpoints (ESC8) that lack Extended Protection for Authentication (EPA). By coercing a Domain Controller (DC) to authenticate and relaying the captured NTLM credentials, an attacker can obtain a DC machine certificate. This certificate is then used via PKINIT to request a TGT, recover the DC's NT hash, and ultimately achieve full domain compromise via DCSync. Essential for advanced AD red-teaming simulations.

This specialized skill guides users through analyzing complex Active Directory Certificate Services (AD CS) abuse scenarios. It is essential for proving how a weakness in a template, CA policy, or issuance right can lead to unauthorized privilege acceptance (e.g., via PKINIT, Schannel). The workflow focuses on mapping the entire certificate issuance chain to the resulting accepted service path.

This specialized skill is designed for deep forensic analysis in complex Windows environments, crucial for CTF and red teaming. It traces identity flows, including Active Directory (AD) origins, Kerberos ticket lifecycles, and OAuth authorization claims. Use it to correlate host artifacts (LSA, DPAPI, Sysmon) with identity evidence to map complete lateral movement and privilege escalation chains.