Skill UI

A comprehensive guide and framework for detecting attacker lateral movement within enterprise networks. It details the use of network flow analysis (Zeek), authentication log review (Windows Event Logs, Kerberos), and dedicated SIEM correlation rules (Splunk, Elastic) to identify techniques like Pass-the-Hash and RDP hopping. Ideal for threat hunters and security engineers building detection pipelines.

This guide details how to hunt for adversary lateral movement (MITRE ATT&CK TA0008) using Splunk's advanced SPL querying capabilities. It focuses on analyzing Windows authentication logs (e.g., Type 3/10 logons), correlating event IDs (4624, 4648) with process creation data (Sysmon), and identifying unusual source-destination relationships across the network to scope the breadth of a compromise.

An advanced Intrusion Detection System (IDS) module designed for Operational Technology (OT) and ICS/SCADA environments. It monitors Modbus TCP/RTU traffic to detect unauthorized writes, anomalous function codes, malformed frames, and deviations from established communication baselines. Essential for investigating suspicious PLC register modifications and responding to industrial threats.

A comprehensive system for detecting anomalies in industrial Modbus/TCP and Modbus RTU traffic. It monitors function codes, validates register ranges, analyzes timing patterns, and uses deep packet inspection combined with Markov chains to identify suspicious activity. Essential for deploying Modbus IDS, baselining polling patterns, and securing Operational Technology (OT) environments against unauthorized commands.

This guide details methods for detecting and mitigating OAuth token theft and replay attacks in cloud environments, specifically targeting Microsoft Entra ID (Azure AD). It covers protection against access token theft, Primary Refresh Token (PRT) abuse, and pass-the-cookie attacks. Users can leverage Conditional Access and Token Protection features to cryptographically bind tokens to devices, significantly enhancing cloud identity security and preventing session hijacking.

A comprehensive guide and workflow for proactively hunting Pass-the-Hash (T1550.002) attacks. This method involves analyzing NTLM authentication patterns, correlating suspicious logon types, and utilizing EDR/SIEM data (Splunk, CrowdStrike) to scope lateral movement during incident response or threat hunting exercises. Essential for validating security detection coverage.

A comprehensive guide and workflow for detecting unauthorized data exfiltration from AWS S3 buckets. It details how to leverage multiple AWS services—including CloudTrail, GuardDuty, Amazon Macie, and Athena—to analyze access patterns, identify bulk downloads, and detect cross-account data transfers, ensuring robust cloud compliance and security monitoring.

This skill analyzes proxy access logs, DNS query logs, and network flow data to identify unauthorized SaaS and cloud services (Shadow IT). It uses Python and pandas to aggregate traffic, classify domains against known SaaS categories, and calculate risk scores based on data volume and user count. Ideal for conducting thorough security audits and generating actionable remediation reports.

This skill detects advanced cyber-physical attacks mimicking the Stuxnet pattern. It monitors for unauthorized modifications to PLC logic and detects discrepancies between reported sensor readings and actual physical process behavior. Ideal for high-security OT/ICS environments when hunting for APT lateral movement or validating process integrity against sophisticated threats.

This skill analyzes Azure AD/Microsoft Entra ID environments to detect illicit OAuth application consent grants. It leverages the Microsoft Graph API and directory audit logs to enumerate permissions, identify overly broad scopes, and flag high-risk applications based on publisher verification status. It is essential for SOC analysts and threat hunters investigating cloud identity security incidents.

A comprehensive guide for threat hunting, detailing detection methods for the abuse of elevation controls (T1548). It covers both Windows environments (UAC bypass via registry modification and auto-elevating binaries like fodhelper.exe) and Linux systems (sudo/setuid abuse). Use this to monitor system events, registry changes, and process relationships to identify unauthorized privilege escalation attempts.

Executes authorized, advanced attack simulations against Active Directory environments to identify critical misconfigurations, weak credentials, and exploitable trust relationships. Utilizing industry tools like BloodHound, Mimikatz, and Impacket, this process simulates complex attacks such as Kerberoasting, Golden Ticket forging, and domain compromise path analysis, helping organizations validate their security posture against real-world threats.