Skill UI

Perform memory forensics using Volatility 3 to analyze RAM dumps, detect process injection, malware, suspicious network connections, and credential theft during incident response, while documenting acquisition steps and evidence for DFIR reporting.

Implements Microsoft’s Enhanced Security Admin Environment (ESAE) tiered Active Directory administration model, covering Tier 0/1/2 separation, privileged access workstations, administrative forest design, authentication policy silos, and credential theft mitigation for enterprise IAM assurance.

Detect Azure AD/Entra ID lateral movement by correlating Microsoft Graph audit logs, sign-in anomalies, and Sentinel KQL rules to surface credential abuse, token theft, and cross-tenant pivots, then automate responses via playbooks.

Detects DCSync abuse in Active Directory by monitoring replication requests, correlating RPC traffic, and flagging non-domain-controller accounts before credential theft can spread.

Guide for hunting DCSync credential theft by analyzing Windows Event ID 4662, filtering unauthorized DS-Replication-Get-Changes requests, correlating with known DCs, and validating findings before response actions.

Guides teams to harden AWS Lambda, Azure Functions, and GCP Cloud Functions by enforcing least-privileged IAM roles, eliminating hardcoded secrets, scanning dependencies, validating inputs, and enabling monitoring so serverless workloads resist injection, credential theft, and supply-chain threats.

Guides penetration testers through identifying CORS misconfigurations that allow unauthorized cross-domain requests, validating Origin handling, invoking preflight checks, and building PoCs to expose credential theft risks during API audits.