Skill UI

A comprehensive guide to deploying cloud-native deception across AWS, Azure, and GCP. This skill utilizes decoy resources—such as canary IAM keys, honey object storage buckets, and decoy secrets—whose sole purpose is to generate high-fidelity alerts the instant they are interacted with by an attacker. It detects cloud reconnaissance, credential theft, and lateral movement by wiring detection through native logging services (CloudTrail, Sentinel, Cloud Audit Logs), ensuring near-zero false positives for the SOC.

This skill details how to abuse the Windows DPAPI (Data Protection API) to extract and decrypt sensitive secrets protected by the OS. It covers multiple scenarios: online decryption (using the target user's context), offline decryption (requiring passwords or NTLM hashes), and advanced domain-wide decryption via the DPAPI backup key. Essential for red-teaming and post-exploitation activities to harvest credentials, browser logins, and Wi-Fi passwords.

This technique abuses the Active Directory's `msDS-KeyCredentialLink` attribute to inject attacker-controlled public keys (Shadow Credentials). After gaining write access (e.g., via BloodHound), the attacker uses tools like pyWhisker or Certipy to append their key. They then authenticate via PKINIT to recover the target's NT hash, achieving complete account takeover without the disruptive step of a password reset. Ideal for stealthy red-teaming engagements.

A comprehensive guide to deploying decoy artifacts, such as fake credentials, URLs, and files, called honeytokens or canarytokens. These tokens have no legitimate operational use; therefore, any interaction with them provides a high-fidelity, low-false-positive signal of an intrusion, data theft, or insider threat. Use this technique to enhance detection in low-telemetry areas like file shares or credential stores.

NetExec is a comprehensive, multi-protocol tool designed for authorized penetration testing and red-teaming. It functions as a 'swiss-army knife' for assessing Windows, Active Directory, and Linux environments. Key capabilities include validating credentials, performing password spraying, enumerating network shares, executing commands across multiple protocols (SMB, WinRM, LDAP, MSSQL, SSH), and dumping critical credentials (SAM, LSA, NTDS). It directly supports techniques for lateral movement and post-exploitation activities.

This technique exploits vulnerable Active Directory Certificate Services (AD CS) HTTP web-enrollment endpoints (ESC8) that lack Extended Protection for Authentication (EPA). By coercing a Domain Controller (DC) to authenticate and relaying the captured NTLM credentials, an attacker can obtain a DC machine certificate. This certificate is then used via PKINIT to request a TGT, recover the DC's NT hash, and ultimately achieve full domain compromise via DCSync. Essential for advanced AD red-teaming simulations.

The Azure CLI command group for managing Azure Container Registry (ACR). This tool allows users to perform the entire ACR lifecycle, including creating registries, authenticating credentials, building and pushing container images (using cloud builds), importing images from other sources, and configuring advanced features like geo-replication, private endpoints, and webhooks. Essential for CI/CD pipelines and container deployment workflows in Azure.

This guide provides a comprehensive methodology for the reverse engineering of browser extensions (Chrome/Firefox). It covers analyzing the manifest, tracing background workers, content scripts, and recovering sensitive logic like credentials or network traffic. Essential for security research, malware investigation, and supply chain security auditing.

This specialized skill is designed for advanced security analysis, tracing the complete trust chain from cloud metadata services to accepted privilege. It is used in penetration testing or CTF environments to meticulously prove how metadata-derived credentials (such as instance identities or tokens) are issued and subsequently accepted by a cloud or control plane API, thereby exposing the decisive trust edge.

This specialized skill is designed for in-depth security and forensic analysis of Windows secrets protected by DPAPI. It maps the entire lifecycle of encrypted credentials, tracing the flow from the initial protected blob or masterkey through the context unwrapping (e.g., user logon, machine context, domain backup keys) to the specific service that finally accepts the plaintext secret. Use this to prove the decisive access edge in a complex compromise scenario.

This specialized skill is designed to analyze complex security flaws involving forced authentication (coercion) and identity relay chains. It guides users to trace and document the complete, minimal path from the initial coercion trigger (e.g., a specific service or protocol edge) through intermediate hops, to the final service that accepts the relayed credentials. Use this for deep security research, forensics, and documenting the decisive sequence leading to privilege escalation or code execution.

A specialized skill for analyzing complex, host-to-host lateral movement chains within a Windows environment. It focuses on tracing protocols like WinRM, SMB, and RDP, replaying captured Kerberos tickets, understanding privilege edges, and identifying the exact accepting service or host that facilitates credential movement. Used in advanced penetration testing and digital forensics scenarios.