Skill UI

A comprehensive guide detailing advanced techniques for attacking Microsoft Active Directory (AD) environments. It covers the entire red team lifecycle, including reconnaissance (BloodHound, PowerView), credential harvesting (Mimikatz, AS-REP Roasting), and critical attacks such as Kerberos exploitation, Pass-the-Ticket/Hash, and NTLM relay attacks. Essential for penetration testing and defensive validation.

A structured framework for managing production outages using Sentry. This guide walks users through classifying incident severity (P0-P3), performing deep triage using stack traces and breadcrumbs, and executing API-based queries to pinpoint root causes and measure impact. Essential for DevOps and SRE teams during critical incident response.

This skill provides comprehensive methods for collecting and synthesizing Open-Source Intelligence (OSINT) regarding threat actors, malicious infrastructure, and attack campaigns. It utilizes public data sources, passive reconnaissance tools (like WHOIS, Certificate Transparency), and specialized platforms (Maltego, Shodan, SpiderFoot) to map adversary context and perform pre-engagement intelligence gathering for authorized red team assessments. Emphasis is placed on passive collection techniques to ensure legality and operational security.

This guide details how to conduct comprehensive external reconnaissance using Open Source Intelligence (OSINT) techniques. It teaches testers to passively map an organization's entire digital footprint, including enumerating subdomains, discovering internet-facing infrastructure (via Shodan/Censys), identifying personnel data, and analyzing leaked credentials from public sources. Ideal for the initial phases of penetration testing or red team engagements.

This comprehensive guide outlines how to plan and execute a full-scope red team engagement. It simulates real-world Advanced Persistent Threat (APT) behavior, covering the entire cyber kill chain from initial reconnaissance (OSINT) through lateral movement, credential harvesting, and data exfiltration. It utilizes MITRE ATT&CK frameworks to rigorously test an organization's detection, prevention, and incident response capabilities.

Pass-the-Ticket (PtT) is a critical post-exploitation technique used in red teaming and offensive security assessments. It allows an attacker to move laterally across a network by utilizing stolen Kerberos tickets (TGT or TGS) without ever needing the user's password. This skill outlines the process of dumping tickets from memory (e.g., LSASS) and injecting them into a current session to impersonate a high-privilege user for access to sensitive resources.

This guide details the end-to-end process of conducting a sophisticated spearphishing simulation campaign, mirroring real red team adversary techniques. It covers initial OSINT research and pretext development, building weaponized payloads that bypass security controls, setting up robust email infrastructure (SPF/DKIM/DMARC), executing the campaign in waves, and performing detailed post-campaign metrics analysis for comprehensive security reporting.

This solution automates the processing of AWS GuardDuty findings using EventBridge and AWS Lambda. It enables real-time incident response capabilities, including automatic quarantine of compromised EC2 resources, comprehensive forensic snapshot creation, and immediate high-severity security notifications via SNS. Ideal for SOC teams seeking to drastically reduce Mean Time To Response (MTTR) and strengthen cloud security posture.

This guide details advanced threat hunting techniques to proactively detect Mimikatz execution. It focuses on identifying command-line patterns, unauthorized access to LSASS memory, binary indicators, and known credential dumping techniques (e.g., DCSync, Golden Tickets). Ideal for security analysts, threat hunters, and incident response teams during proactive assessments or active compromise investigation.

Executes comprehensive red team exercises that mimic real-world adversary operations across people, processes, and technology. This capability simulates the full attack lifecycle, from initial reconnaissance to objective completion, specifically testing an organization's detection, response, and containment mechanisms. It focuses on adversary emulation and complex attack chains, differentiating it from standard vulnerability scanning or penetration testing.

This guide details the exploitation of the Active Directory Certificate Services (AD CS) ESC1 vulnerability. By leveraging misconfigurations, an attacker can request certificates impersonating high-privileged users (e.g., Domain Admins). The workflow covers AD enumeration, forging certificates with arbitrary Subject Alternative Names (SANs), authenticating via PKINIT, and ultimately escalating domain privileges using tools like mimikatz. Essential for authorized red team and penetration testing.

Provides a structured methodology for proactive threat hunting against Living-off-the-Land Binaries (LOLBins). It guides practitioners in identifying techniques where adversaries abuse legitimate system tools (like certutil, mshta, rundll32) to execute payloads while bypassing traditional security controls (AV/EDR). Ideal for incident response, red team validation, and improving detection coverage against fileless attacks.