Skill UI

This skill allows users to build comprehensive attack trees to systematically visualize complex threat paths. It is essential for mapping potential attack scenarios, identifying critical defense gaps, prioritizing security investments, and communicating detailed security risks to non-technical stakeholders.

This skill allows users to build comprehensive attack trees to systematically visualize complex threat paths. It is essential for mapping potential attack scenarios, identifying critical defense gaps, prioritizing security investments, and communicating detailed security risks to non-technical stakeholders.

Provides expert guidance on secure and performant file upload mechanisms for cloud environments. Covers best practices for using services like AWS S3 and Cloudflare R2, including implementing presigned URLs, handling large files via streaming, and optimizing images. Crucially emphasizes critical security measures such as validating file types using magic bytes, enforcing size limits, and preventing path traversal attacks.

Delivers repository-grounded AppSec threat models that map components, boundaries, assets, entry points, and attacker capabilities to abuse paths, along with prioritized mitigations tailored to codebase evidence and explicit assumptions.

A comprehensive guide to conducting internal Active Directory reconnaissance using BloodHound Community Edition. This skill leverages graph theory to visualize hidden relationships, map shortest attack paths, and discover critical misconfigurations (like ACL weaknesses and Kerberoastable accounts) necessary for privilege escalation from low-privilege accounts to high-value targets like Domain Admins.

This guide outlines a comprehensive threat hunting methodology for detecting adversary lateral movement within a network environment. It utilizes Splunk SPL queries against rich Windows event data, including authentication logs (4624, 4625), SMB traffic, and Sysmon telemetry. By correlating source-to-destination activity and identifying unusual logon types (RDP, WinRM, SMB), users can proactively track an attacker's path after initial system compromise, fulfilling MITRE ATT&CK T1021 techniques.

A guide for security professionals and threat hunters to proactively detect advanced privilege escalation techniques across Windows and Linux environments. It covers critical attack methods including token manipulation, UAC bypass, unquoted service paths, and kernel exploits, utilizing EDR and SIEM data sources for comprehensive incident response and security assessments.

Executes authorized, advanced attack simulations against Active Directory environments to identify critical misconfigurations, weak credentials, and exploitable trust relationships. Utilizing industry tools like BloodHound, Mimikatz, and Impacket, this process simulates complex attacks such as Kerberoasting, Golden Ticket forging, and domain compromise path analysis, helping organizations validate their security posture against real-world threats.

BloodHound is a powerful, graph-based reconnaissance tool specifically designed for Active Directory environments. It utilizes graph theory to map deep, hidden relationships and potential attack paths—such as privilege escalation chains—from compromised low-value accounts to high-value targets like Domain Admins. This tool is essential for authorized red team exercises and penetration testing engagements.

Use XM Cyber to continuously map attack paths, uncover choke points, and prioritize the small set of exposures that can threaten critical assets across on-prem, cloud, and hybrid environments.

BloodHound is an open-source reconnaissance tool that leverages graph theory to analyze Active Directory relationships. This guide details the process of collecting AD data using SharpHound and visualizing complex attack paths. It helps identify potential privilege escalation chains, trust abuses, and misconfigurations necessary for an attacker to move from a low-privilege user account to Domain Admin, making it essential for advanced red-teaming and security auditing.

This skill systematically enumerates and audits Active Directory forest trust relationships using advanced techniques like SID filtering analysis, detecting SID history abuse, and assessing inter-realm Kerberos ticket configurations. It is designed for red-teaming and security auditing to identify potential lateral movement paths and trust vulnerabilities across organizational boundaries.