Skill UI

This skill helps detect NTLM relay attacks (T1557.001) by analyzing Windows Security Event ID 4624 (logon type 3) for NTLMSSP usage. It flags critical anomalies such as IP-to-hostname mismatches, evidence of LLMNR/NBT-NS poisoning, rapid cross-domain authentication, and verifies SMB signing status. It is essential for proactive threat hunting and security incident investigation in Active Directory environments.

This guide provides comprehensive security hardening procedures for enterprise Google Workspace environments. It covers advanced topics such as enforcing phishing-resistant Multi-Factor Authentication (MFA), configuring email authentication (DMARC/SPF/DKIM), implementing Data Loss Prevention (DLP), and securing super admin accounts using Advanced Protection Program enrollment. Ideal for achieving high compliance and defending against BEC and phishing attacks.

Implement robust, phishing-resistant authentication using FIDO2/WebAuthn standards. This guide covers integrating WebAuthn APIs, configuring FIDO2 servers, managing passkey enrollment, and migrating systems away from traditional passwords. Essential for meeting high-assurance security standards like NIST SP 800-63B AAL3.