Skill UI

A comprehensive guide detailing advanced techniques for attacking Microsoft Active Directory (AD) environments. It covers the entire red team lifecycle, including reconnaissance (BloodHound, PowerView), credential harvesting (Mimikatz, AS-REP Roasting), and critical attacks such as Kerberos exploitation, Pass-the-Ticket/Hash, and NTLM relay attacks. Essential for penetration testing and defensive validation.

A specialized tool designed for incident responders and threat hunters. It extracts critical configuration data—such as C2 server addresses, malleable profiles, watermarks, and communication settings—from Cobalt Strike beacon payloads found in PE files or memory dumps. This analysis is crucial for mapping attacker infrastructure and improving defensive detection rules.

This skill analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework. It identifies which attack phases an adversary has completed, points where defenses failed or succeeded, and recommends controls to disrupt the attack at earlier stages. It is essential for post-incident analysis, threat intelligence reporting, and designing robust defense-in-depth strategies.

This comprehensive toolkit provides deep static analysis capabilities for suspicious PDF documents. Using tools like PDFiD, pdf-parser, and peepdf, it identifies embedded malicious structures—including JavaScript code, shellcode, auto-actions, and exploit kits—without opening or rendering the file. It is essential for security analysts conducting threat triage, forensic investigation, and assessing potential attack vectors from suspicious attachments.

This skill provides comprehensive methods for collecting and synthesizing Open-Source Intelligence (OSINT) regarding threat actors, malicious infrastructure, and attack campaigns. It utilizes public data sources, passive reconnaissance tools (like WHOIS, Certificate Transparency), and specialized platforms (Maltego, Shodan, SpiderFoot) to map adversary context and perform pre-engagement intelligence gathering for authorized red team assessments. Emphasis is placed on passive collection techniques to ensure legality and operational security.

This guide details the methodology for conducting internal network penetration tests, simulating an attacker operating from an assumed breach state. It covers initial network reconnaissance, Active Directory enumeration, advanced credential harvesting techniques (e.g., Kerberoasting, Pass-the-Hash), and lateral movement exploitation to determine the full blast radius of a potential breach. Essential for comprehensive security auditing.

A comprehensive guide to simulating Man-in-the-Middle (MITM) attacks using industry-standard tools like Bettercap, Ettercap, and mitmproxy. This technique is strictly for authorized penetration testing environments to assess cryptographic controls, validate TLS certificate pinning, and test network defense mechanisms against ARP/DNS spoofing and sniffing.

Pass-the-Ticket (PtT) is a critical post-exploitation technique used in red teaming and offensive security assessments. It allows an attacker to move laterally across a network by utilizing stolen Kerberos tickets (TGT or TGS) without ever needing the user's password. This skill outlines the process of dumping tickets from memory (e.g., LSASS) and injecting them into a current session to impersonate a high-privilege user for access to sensitive resources.

This comprehensive guide details the architecture and implementation of VLAN-based network segmentation on managed switches. It teaches professionals how to isolate different network zones (e.g., corporate, DMZ, IoT) to enforce strong access controls, reduce the attack surface, and meet compliance standards like PCI-DSS. The workflow includes designing the VLAN plan, configuring trunking, hardening switches against VLAN hopping, and setting up inter-VLAN routing with ACLs.

This comprehensive guide provides a structured, multi-stage workflow for containing active security breaches. It details both short-term and long-term strategies, including network segmentation, endpoint isolation, credential revocation, and evidence preservation. Use this process during confirmed intrusions, ransomware attacks, or lateral movement events to effectively stop adversary activity and secure critical assets before eradication.

This skill guides SOC analysts and detection engineers on how to correlate complex, multi-stage attacks within the IBM QRadar SIEM platform. It covers advanced usage of AQL (Ariel Query Language) for deep event investigation, building custom correlation rules (Building Blocks and Offenses), and cross-source data correlation (e.g., auth failures with network flows). It is essential for reducing false positives and improving threat detection accuracy.

A comprehensive guide for security professionals on detecting and preventing ARP spoofing and poisoning attacks. The skill covers multiple layers of defense, including implementing Dynamic ARP Inspection (DAI) on managed switches, utilizing ARPWatch for continuous monitoring, performing deep packet inspection with Wireshark, and developing custom Python scripts for real-time anomaly detection. Essential for mitigating Man-in-the-Middle (MitM) attacks at Layer 2.