Skill UI

A comprehensive guide and set of detection rules for identifying OS credential dumping techniques (MITRE T1003). It leverages EDR telemetry, Sysmon process access monitoring, and Windows security event correlation to detect attacks targeting LSASS memory, SAM databases, and NTDS.dit files. Essential for proactive threat hunting and incident response.

This skill details the deployment of Privileged Access Management (PAM) for critical database systems, including Oracle, SQL Server, PostgreSQL, and MySQL. It covers essential security controls such as session proxy configuration, credential vaulting, query auditing, and enforcing least-privilege access, helping organizations meet stringent compliance and security standards.

This guide details the comprehensive implementation of privileged session monitoring and recording using Privileged Access Management (PAM) solutions, such as CyberArk PSM. It covers essential steps including architectural routing, configuring keystroke logging, real-time risk analysis, and establishing secure, tamper-proof audit trails for critical administrative access (RDP, SSH, Databases). Essential for meeting strict compliance standards like SOX, HIPAA, and PCI-DSS.

LaZagne is an open-source post-exploitation tool utilized by red teams to harvest stored credentials from compromised endpoints. It supports Windows, Linux, and macOS, extracting passwords from browsers (Chrome, Edge), databases (MySQL, SQLite), system vaults (DPAPI, LSA), and various applications. It is crucial for privilege escalation and lateral movement during authorized security assessments.

This skill provides comprehensive capability to discover and inventory all privileged accounts across an enterprise infrastructure. It covers domain admins, local admins, service accounts, database roles, and cloud IAM roles. It is essential for security assessments, incident response, and compliance auditing, helping to establish a complete baseline for Privileged Access Management (PAM).

A comprehensive skill for auditing service accounts across complex enterprise environments, including Active Directory, major cloud platforms (AWS, Azure, GCP), and databases. It identifies risks such as orphaned accounts, over-privileged access, and non-compliant credentials, ensuring adherence to industry standards like SOX, PCI DSS, and HIPAA. Used during security assessments and compliance reviews.

Implements HashiCorp Vault's dynamic secrets engine to automatically generate, lease, and rotate short-lived credentials for databases (e.g., Postgres, MySQL), AWS IAM keys, and PKI certificates. This eliminates the risk associated with storing static secrets, ensuring compliance with zero-trust principles and automating the entire secret lifecycle.