Skill UI

Configures Microsoft Defender for Endpoint advanced protections (ASR, controlled folder access, network and exploit settings) through PowerShell or Intune/SCCM policies to harden Windows endpoints and meet compliance expectations.

Guides hardening Windows Active Directory via Group Policy to block ransomware execution, enforce AppLocker/WDAC rules, enable Controlled Folder Access, configure ASR, and lock down lateral movement paths.

This advanced skill explores offensive reconnaissance techniques focused on defeating modern operating system security boundaries and mitigations. Topics include kernel/user boundary manipulation, sandbox escapes (AppContainer, LPAC), COM/RPC boundary exploitation, hypervisor interactions, and various integrity level bypassing methods. It is essential for planning advanced privilege escalation paths and understanding deep Windows security architecture, including AMSI, WDAC, and ETW manipulation.