Skill UI

This tool provides a comprehensive workflow for performing deep forensic investigations on AWS environments. By leveraging CloudTrail logs and programmatic access via boto3/Athena, users can reconstruct attacker activity, identify compromised credentials, analyze suspicious API call patterns, and generate detailed incident response reports.

LaZagne is an open-source post-exploitation tool utilized by red teams to harvest stored credentials from compromised endpoints. It supports Windows, Linux, and macOS, extracting passwords from browsers (Chrome, Edge), databases (MySQL, SQLite), system vaults (DPAPI, LSA), and various applications. It is crucial for privilege escalation and lateral movement during authorized security assessments.

Open Source Intelligence (OSINT) is the critical first phase of red team engagements. This guide details how to systematically collect publicly available data about a target organization. It covers mapping network assets (domains, IPs), identifying personnel for social engineering, discovering credential leaks, and mapping the entire technology stack. Use this skill during authorized security assessments to build comprehensive attack surface maps and initial access strategies.

This skill provides a comprehensive framework for performing privilege escalation assessments post-initial compromise. It guides testers in identifying paths from low-privilege access to root or SYSTEM-level control on both Linux and Windows operating systems. Techniques covered include abusing SUID binaries, exploiting misconfigured services, leveraging kernel vulnerabilities, and harvesting credentials.

A comprehensive skill for auditing service accounts across complex enterprise environments, including Active Directory, major cloud platforms (AWS, Azure, GCP), and databases. It identifies risks such as orphaned accounts, over-privileged access, and non-compliant credentials, ensuring adherence to industry standards like SOX, PCI DSS, and HIPAA. Used during security assessments and compliance reviews.

This skill details the deployment of various canary tokens (DNS, HTTP, AWS API Keys) across enterprise network infrastructure. It establishes digital tripwires that detect behavioral anomalies, such as unauthorized access, credential leakage, or lateral movement. Tokens are configured with webhook alerts (Slack, SIEM) for real-time, low-false-positive notification, significantly enhancing traditional IDS/IPS capabilities.

This guide outlines best practices for configuring and securing Adobe API access across Development, Staging, and Production environments. It details the use of separate Developer Console projects, implementing least-privilege OAuth scopes, and integrating robust secret management solutions (GCP Secret Manager, AWS Secrets Manager, HashiCorp Vault) into CI/CD pipelines for secure, scalable deployments.

This skill guides the architecture and implementation of SAML 2.0 identity federation between on-premises Active Directory and Microsoft Entra ID (Azure AD). It covers establishing seamless Single Sign-On (SSO) capabilities, eliminating the need for separate credentials and ensuring secure, cross-domain authentication for cloud applications.

This guide provides a comprehensive approach to securing AWS Identity and Access Management (IAM) configurations. It walks practitioners through inventorying existing permissions, using Access Analyzer to identify overly permissive policies, implementing specific resource scoping, and attaching permission boundaries. Key strategies include enforcing least privilege access, managing credential rotation, and meeting stringent compliance requirements like SOC 2 and PCI-DSS.

This skill guides the comprehensive hardening of LDAP directory services. It addresses common vulnerabilities such as LDAP injection, anonymous binding, and credential harvesting. Users can enforce strong security controls, including LDAPS, channel binding, and granular access control lists (ACLs). It is essential when establishing robust identity access management (IAM) architecture or meeting stringent compliance requirements like NIST standards.

This skill provides comprehensive guidance on detecting post-exploitation credential dumping activities, such as LSASS memory access, SAM registry hive extraction, and NTDS.dit theft. It utilizes advanced log sources, including Sysmon Event ID 10 (ProcessAccess), Windows Security logs, and SIEM correlation rules, to identify suspicious process behaviors and malicious tool usage, mapping these detections to MITRE ATT&CK techniques.

Implements HashiCorp Vault's dynamic secrets engine to automatically generate, lease, and rotate short-lived credentials for databases (e.g., Postgres, MySQL), AWS IAM keys, and PKI certificates. This eliminates the risk associated with storing static secrets, ensuring compliance with zero-trust principles and automating the entire secret lifecycle.