Skill UI

This guide is crucial for threat hunters investigating Active Directory compromises. It details how to monitor Windows Security Event ID 4662 to detect unauthorized attempts by non-domain-controller accounts to access critical directory replication GUIDs. These anomalies are strong indicators of DCSync attacks, which are used by attackers (e.g., using Mimikatz) to dump hashes, perform lateral movement, and execute credential theft.

This skill guides the detection of Golden Ticket attacks within Active Directory by analyzing Kerberos logs (Event IDs 4768, 4769, 4771). It hunts for critical anomalies, such as mismatched encryption types (e.g., RC4 in AES environments), impossible ticket lifetimes, or service tickets appearing without a prior ticket grant request. This is essential for post-breach assessment and advanced threat hunting in domain environments.

This skill provides structured procedures for detecting Golden Ticket attacks, a severe threat involving forging Kerberos Tickets in Active Directory. It analyzes Windows Event ID 4769 for indicators such as RC4 encryption downgrades, abnormal ticket lifetimes, and inconsistencies in TGS/TGT requests. Designed for SOC analysts and threat hunters using SIEM platforms (Splunk/Elastic) to enhance security monitoring coverage against credential theft.

This skill analyzes Azure AD/Microsoft Entra ID environments to detect illicit OAuth application consent grants. It leverages the Microsoft Graph API and directory audit logs to enumerate permissions, identify overly broad scopes, and flag high-risk applications based on publisher verification status. It is essential for SOC analysts and threat hunters investigating cloud identity security incidents.

Executes authorized, advanced attack simulations against Active Directory environments to identify critical misconfigurations, weak credentials, and exploitable trust relationships. Utilizing industry tools like BloodHound, Mimikatz, and Impacket, this process simulates complex attacks such as Kerberoasting, Golden Ticket forging, and domain compromise path analysis, helping organizations validate their security posture against real-world threats.

This guide details the exploitation of the Active Directory Certificate Services (AD CS) ESC1 vulnerability. By leveraging misconfigurations, an attacker can request certificates impersonating high-privileged users (e.g., Domain Admins). The workflow covers AD enumeration, forging certificates with arbitrary Subject Alternative Names (SANs), authenticating via PKINIT, and ultimately escalating domain privileges using tools like mimikatz. Essential for authorized red team and penetration testing.

BloodHound is a powerful, graph-based reconnaissance tool specifically designed for Active Directory environments. It utilizes graph theory to map deep, hidden relationships and potential attack paths—such as privilege escalation chains—from compromised low-value accounts to high-value targets like Domain Admins. This tool is essential for authorized red team exercises and penetration testing engagements.

This technique details how to exploit misconfigurations within Kerberos Constrained Delegation (KCD) in Active Directory. By leveraging S4U2self and S4U2proxy extensions, attackers can impersonate highly privileged users (e.g., Domain Admins) to request service tickets, enabling lateral movement and full domain compromise during authorized red teaming or penetration testing.

A comprehensive guide detailing the Kerberoasting technique (T1558.003) used in Active Directory environments. This method exploits service accounts by requesting and subsequently cracking Kerberos TGS tickets offline, allowing attackers to compromise credentials. Instructions cover enumeration, ticket request, cracking with tools like Hashcat/John the Ripper, and credential validation, for authorized red team and penetration testing purposes.

This skill details exploiting the noPac vulnerability chain, combining CVE-2021-42278 (sAMAccountName spoofing) and CVE-2021-42287 (KDC PAC confusion). It allows an authenticated standard domain user to escalate privileges to Domain Admin, potentially compromising the entire domain. It is designed for authorized red team exercises and penetration testing against vulnerable Active Directory environments.

This skill details the exploitation of the critical Zerologon vulnerability (CVE-2020-1472) found in the Microsoft Netlogon Remote Protocol. It allows an unauthenticated attacker to compromise a domain controller by resetting its machine account password. The guide covers the complete attack chain, including initial exploitation, credential dumping via DCSync, and subsequent privilege escalation in Active Directory environments. Used exclusively for authorized red teaming and security testing.

This guide details how to hunt for DCSync attacks, a technique used to steal password hashes from Active Directory. It involves analyzing Windows Event ID 4662 to identify unauthorized DS-Replication-Get-Changes requests originating from non-domain-controller accounts. Essential for incident response and threat detection.