Skill UI

A comprehensive guide and workflow for detecting Mimikatz and similar credential-dumping activities. It utilizes command-line pattern matching, LSASS memory access signatures, binary indicators, and in-memory analysis. Ideal for threat hunting, scoping compromises during incident response, or validating detection coverage in purple team exercises using EDR/SIEM data.

This guide details how to hunt for DCSync attacks (MITRE ATT&CK T1003.006) in Active Directory environments. It focuses on analyzing Windows Security Event ID 4662, specifically looking for DS-Replication-Get-Changes requests originating from non-domain-controller accounts. This technique is critical for incident response, purple teaming, and detecting unauthorized credential theft via Active Directory replication abuse.

This framework executes sophisticated threat emulation tests using Atomic Red Team, mapping directly to MITRE ATT&CK techniques. It allows security teams to actively simulate adversary behavior, validating the detection coverage of SIEM rules and EDR controls. Use this tool for comprehensive purple team operations, penetration testing, and security auditing.

This skill provides comprehensive detection strategies for adversaries abusing DCOM objects (e.g., MMC20.Application) to perform stealthy lateral movement (MITRE ATT&CK T1021.003). It details how to correlate Sysmon Event IDs (Process Creation, Network Connection), analyze WMI activity, and monitor RPC traffic on port 135 to identify unauthorized remote command execution chains. Ideal for advanced threat hunting, red teaming, and purple team exercises.