Skill UI

This skill provides a comprehensive framework for detecting various privilege escalation techniques across Windows and Linux. It covers access token manipulation, UAC bypass, unquoted service path abuse, and kernel exploits. It is essential for threat hunting, scoping compromise during incident response, and validating detection coverage in proactive security assessments.

Executes authorized, advanced attack simulations against Active Directory environments to identify critical misconfigurations, weak credentials, and exploitable trust relationships. Utilizing industry tools like BloodHound, Mimikatz, and Impacket, this process simulates complex attacks such as Kerberoasting, Golden Ticket forging, and domain compromise path analysis, helping organizations validate their security posture against real-world threats.

This guide details the exploitation of the critical Zerologon vulnerability (CVE-2020-1472) in Active Directory Domain Controllers. It demonstrates the methodology for resetting the DC machine account password to empty, achieving full domain compromise. Subsequent steps include dumping domain credentials using DCSync. Essential for authorized red-teaming and security validation.

This utility performs comprehensive forensic analysis on memory dumps. It leverages industry-standard tools like Volatility and Mimikatz to extract sensitive information, including cached credentials, NTLM/LM hashes, Kerberos tickets, and authentication tokens. It is crucial for incident response, assessing the scope of credential compromise, and investigating lateral movement attacks.

This skill guides proactive security auditing and threat hunting for registry-based persistence artifacts (MITRE T1547) in Windows environments. It focuses on identifying mechanisms such as Run/RunOnce keys, Winlogon modifications, IFEO debugger injection, and COM hijacking to detect malware autostart techniques and scope compromises during incident response.

A comprehensive guide for conducting hypothesis-driven threat hunting against supply chain compromises (T1195). This skill focuses on querying SIEM/EDR logs to detect indicators of trojanized software updates, compromised dependencies, unauthorized code modifications, and tampered build artifacts. It is crucial when investigating suspected vendor compromises or scoping a build pipeline breach, requiring advanced knowledge of logging systems and threat intelligence.

A comprehensive guide to implementing Mimecast Targeted Threat Protection (TTP). This suite defends against sophisticated phishing, spearphishing, and Business Email Compromise (BEC) attacks by integrating four core modules: URL Protect, Attachment Protect, Impersonation Protect, and Internal Email Protect. Follow the detailed workflow to secure your organizational communications and meet compliance standards.

A comprehensive guide and workflow for digital forensic investigators to analyze ransomware artifacts. This process involves preserving volatile evidence (memory dumps), identifying the ransomware variant from file extensions and ransom notes, establishing the attack timeline using Prefetch and Event Logs, and extracting critical Indicators of Compromise (IoCs) such as Bitcoin addresses and Tor sites. Essential for incident response and recovery planning.

A comprehensive guide for incident responders detailing how to investigate Active Directory (AD) compromises. This skill covers analyzing critical components like NTDS.dit integrity, detecting Kerberos anomalies (Golden/Silver Tickets), tracing lateral movement, and identifying Group Policy abuse to reconstruct attacker activity and determine the full scope of a breach.

This guide details the methodology and tools for conducting authorized privilege escalation assessments within AWS environments. It systematically utilizes specialized tools like Pacu and Principal Mapper (PMapper) to identify critical IAM misconfigurations, excessive permissions, and weak cross-account trust relationships. It is essential for validating the principle of least privilege and assessing the potential blast radius of compromised credentials during authorized penetration testing.

A comprehensive guide to investigating AWS account compromises by querying CloudTrail logs. Use boto3 or AWS Athena to filter suspicious activities—such as unauthorized API calls, S3 data exfiltration, or IAM privilege escalation—to reconstruct a detailed attacker timeline and generate a professional forensic report.

Provides detailed, cloud-native procedures for containing security incidents across major platforms (AWS, Azure, GCP). The guide outlines how to revoke compromised IAM credentials, isolate resources using network security groups and ACLs, and preserve forensic evidence through snapshots and policy enforcement, minimizing lateral movement risk during an active breach.