Skill UI

A comprehensive guide for incident responders detailing how to investigate Active Directory (AD) compromises. This skill covers analyzing critical components like NTDS.dit integrity, detecting Kerberos anomalies (Golden/Silver Tickets), tracing lateral movement, and identifying Group Policy abuse to reconstruct attacker activity and determine the full scope of a breach.

This skill utilizes Impacket to perform comprehensive audits and simulated attacks on Active Directory forest trust relationships. It enumerates trust boundaries, analyzes SID filtering configurations, detects SID history abuse vectors, and assesses inter-realm Kerberos ticket risks. Ideal for red-teaming multi-forest environments or performing deep security audits to find cross-forest privilege escalation paths.

This comprehensive guide details the methodology for Active Directory (AD) penetration testing. It covers deep domain enumeration, utilizing tools like BloodHound and Impacket, and executing advanced attacks such as Kerberoasting, AS-REP Roasting, and privilege escalation via delegation abuse. Use this when conducting authorized security assessments to discover and exploit misconfigurations to achieve domain compromise.

This skill guides comprehensive Active Directory (AD) security assessment using industry-standard tools like PingCastle, BloodHound, and Purple Knight. It helps identify critical misconfigurations, excessive privileges, weak Kerberos settings, and potential lateral movement paths. Ideal for penetration testing, security audits, and incident response to proactively secure enterprise identity management systems.

Kerberoasting is a post-exploitation technique used in Active Directory environments. It targets service accounts by requesting encrypted Kerberos TGS tickets for accounts with Service Principal Names (SPNs). These tickets are then cracked offline using tools like hashcat to recover the service account's NTLM credentials. This skill is intended only for authorized red team engagements and penetration testing to assess AD privilege escalation risks.

A comprehensive skill for auditing service accounts across complex enterprise environments, including Active Directory, major cloud platforms (AWS, Azure, GCP), and databases. It identifies risks such as orphaned accounts, over-privileged access, and non-compliant credentials, ensuring adherence to industry standards like SOX, PCI DSS, and HIPAA. Used during security assessments and compliance reviews.

This skill guide provides a comprehensive framework for automating the secure rotation of service account credentials. It addresses the challenge of managing long-lived secrets across diverse environments, including Active Directory, AWS, GCP, Azure, and databases. By implementing centralized secrets management (like HashiCorp Vault) and automated workflows, users can systematically eliminate stale credentials, dramatically reducing the risk of security breaches and non-compliance.

A comprehensive, NIST/CISA-aligned workflow for structured recovery following a ransomware incident. It covers critical steps including environment isolation, forensic evidence preservation, Active Directory restoration (DSRM, krbtgt reset), backup integrity validation, and phased, dependency-based system rebuild. Essential for post-incident disaster recovery planning.

This tool automates the deployment of deception-based honeytokens within Active Directory environments. It creates fake privileged accounts, decoy SPNs for Kerberoasting detection, and misleading GPOs with password traps. Designed for advanced security teams to detect reconnaissance, lateral movement, and credential theft with high fidelity.

This skill provides a comprehensive framework for detecting NTLM relay attacks (T1557.001). It achieves this by correlating Windows Security Event 4624 (LogonType 3) to identify IP-to-hostname mismatches, detecting artifacts from Responder/LLMNR poisoning, and auditing SMB/LDAP protocol signing weaknesses. Use it for proactive threat hunting in Active Directory environments, investigating authentication anomalies, or building SIEM correlation rules.

A comprehensive guide to hardening Windows Active Directory environments using Group Policy Objects (GPO). This skill configures multiple layers of defense, including AppLocker, Controlled Folder Access, and Attack Surface Reduction (ASR) rules, to prevent ransomware execution paths, block unauthorized file modifications, and restrict lateral movement across the domain.

Comprehensive reference for red teamers and penetration testers on executing Active Directory attacks, covering reconnaissance, credential harvesting, Kerberos abuses, lateral movement, and domain persistence techniques against Windows domains.