Skill UI

A detailed guide and set of queries for detecting Golden Ticket attacks in Active Directory environments. This methodology analyzes Kerberos TGT anomalies, including mismatched encryption types (e.g., RC4 in AES-only domains), impossible ticket lifetimes, and TGS requests lacking prior TGTs. Use this during threat hunting or post-breach assessment when the KRBTGT account hash may be compromised.

Utilizes SIEM platforms (Splunk/Elastic) and Windows Event Log analysis (ID 4769) to detect indicators of Golden Ticket attacks. This skill analyzes Kerberos logs for specific anomalies such as RC4 encryption downgrades, abnormal ticket lifetimes, and correlation failures between TGT and TGS requests, crucial for advanced threat hunting in Active Directory environments.

A comprehensive guide for detecting Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests (Event ID 4769). This technique targets service accounts with Service Principal Names (SPNs), which are requested offline by attackers to crack service account passwords. Use this during threat hunting or incident response to scope MITRE T1558 credential access activities in Active Directory environments.

This skill analyzes Azure AD/Microsoft Entra ID environments to detect illicit OAuth application consent grants. It leverages the Microsoft Graph API and directory audit logs to enumerate permissions, identify overly broad scopes, and flag high-risk applications based on publisher verification status. It is essential for SOC analysts and threat hunters investigating cloud identity security incidents.

Executes authorized, advanced attack simulations against Active Directory environments to identify critical misconfigurations, weak credentials, and exploitable trust relationships. Utilizing industry tools like BloodHound, Mimikatz, and Impacket, this process simulates complex attacks such as Kerberoasting, Golden Ticket forging, and domain compromise path analysis, helping organizations validate their security posture against real-world threats.

This guide details the exploitation of the Active Directory Certificate Services (AD CS) ESC1 vulnerability. By leveraging misconfigurations, an attacker can request certificates impersonating high-privileged users (e.g., Domain Admins). The workflow covers AD enumeration, forging certificates with arbitrary Subject Alternative Names (SANs), authenticating via PKINIT, and ultimately escalating domain privileges using tools like mimikatz. Essential for authorized red team and penetration testing.

BloodHound is a powerful, graph-based reconnaissance tool specifically designed for Active Directory environments. It utilizes graph theory to map deep, hidden relationships and potential attack paths—such as privilege escalation chains—from compromised low-value accounts to high-value targets like Domain Admins. This tool is essential for authorized red team exercises and penetration testing engagements.

Details techniques for exploiting misconfigured Kerberos Constrained Delegation (KCD) in Active Directory. By abusing the S4U2Self and S4U2Proxy protocols, attackers can impersonate highly privileged users (e.g., Domain Admins) to achieve lateral movement or full domain compromise during authorized red-team engagements.

Kerberoasting is a credential access attack (T1558.003) targeting Active Directory service accounts with Service Principal Names (SPNs). This skill demonstrates using Impacket to request Kerberos TGS tickets for these accounts. The resulting RC4 or AES-encrypted tickets are then cracked offline using tools like Hashcat or John the Ripper, allowing attackers to recover service account credentials for lateral movement during authorized penetration testing or red-team engagements.

This guide details the exploitation chain for noPac, combining CVE-2021-42278 (sAMAccountName spoofing) and CVE-2021-42287 (KDC PAC confusion). It demonstrates how an attacker can escalate from a standard domain user to Domain Admin by manipulating Active Directory tickets and performing DCSync. Primarily used in authorized red-teaming and penetration testing to validate domain security.

This guide details the exploitation of the critical Zerologon vulnerability (CVE-2020-1472) in Active Directory Domain Controllers. It demonstrates the methodology for resetting the DC machine account password to empty, achieving full domain compromise. Subsequent steps include dumping domain credentials using DCSync. Essential for authorized red-teaming and security validation.

Detects data-staging activity (MITRE ATT&CK T1074) by analyzing EDR/Sysmon process-creation and file-system telemetry. This skill monitors for archive creation (7-Zip, RAR, tar), unusual file consolidation from multiple directories, and suspicious activity in temporary or hidden paths. It is essential for threat hunting, building robust detection rules, and validating security monitoring coverage against data exfiltration attempts.