Skill UI

This guide is crucial for threat hunters investigating Active Directory compromises. It details how to monitor Windows Security Event ID 4662 to detect unauthorized attempts by non-domain-controller accounts to access critical directory replication GUIDs. These anomalies are strong indicators of DCSync attacks, which are used by attackers (e.g., using Mimikatz) to dump hashes, perform lateral movement, and execute credential theft.

This skill provides a comprehensive framework for detecting data exfiltration attempts that utilize DNS tunneling. It analyzes DNS logs for anomalies such as high Shannon entropy in subdomains, excessive query volume, abnormal query lengths, and misuse of TXT/CNAME records. It is ideal for SOC analysts and security engineers building advanced threat detection rules and performing threat hunting.

This skill provides a methodology to detect data exfiltration attempts hidden within DNS queries. By analyzing Zeek dns.log files, the agent computes Shannon entropy of subdomains, flags unusually long labels, and monitors unique subdomain counts per parent domain. This technique is crucial for identifying malicious tunneling tools like dnscat2 or iodine that bypass traditional security controls.

This skill guides the detection of Golden Ticket attacks within Active Directory by analyzing Kerberos logs (Event IDs 4768, 4769, 4771). It hunts for critical anomalies, such as mismatched encryption types (e.g., RC4 in AES environments), impossible ticket lifetimes, or service tickets appearing without a prior ticket grant request. This is essential for post-breach assessment and advanced threat hunting in domain environments.

This skill analyzes network logs, including proxy access logs, DNS query logs, and netflow data, to detect unauthorized Software as a Service (SaaS) applications and cloud services (Shadow IT). It classifies domains against known catalogs, measures data exfiltration volumes, calculates risk scores, and generates comprehensive reports for security and compliance teams.

Executes authorized, advanced attack simulations against Active Directory environments to identify critical misconfigurations, weak credentials, and exploitable trust relationships. Utilizing industry tools like BloodHound, Mimikatz, and Impacket, this process simulates complex attacks such as Kerberoasting, Golden Ticket forging, and domain compromise path analysis, helping organizations validate their security posture against real-world threats.

This guide details the exploitation of the Active Directory Certificate Services (AD CS) ESC1 vulnerability. By leveraging misconfigurations, an attacker can request certificates impersonating high-privileged users (e.g., Domain Admins). The workflow covers AD enumeration, forging certificates with arbitrary Subject Alternative Names (SANs), authenticating via PKINIT, and ultimately escalating domain privileges using tools like mimikatz. Essential for authorized red team and penetration testing.

BloodHound is a powerful, graph-based reconnaissance tool specifically designed for Active Directory environments. It utilizes graph theory to map deep, hidden relationships and potential attack paths—such as privilege escalation chains—from compromised low-value accounts to high-value targets like Domain Admins. This tool is essential for authorized red team exercises and penetration testing engagements.

A comprehensive guide for discovering and exploiting broken link hijacking vulnerabilities. This skill focuses on identifying references to expired domains, decommissioned cloud resources (like S3 buckets), and dead external services. It covers advanced techniques such as subdomain takeover, supply chain security assessment, and resource claiming for authorized penetration testing.

This technique details how to exploit misconfigurations within Kerberos Constrained Delegation (KCD) in Active Directory. By leveraging S4U2self and S4U2proxy extensions, attackers can impersonate highly privileged users (e.g., Domain Admins) to request service tickets, enabling lateral movement and full domain compromise during authorized red teaming or penetration testing.

This skill details exploiting the noPac vulnerability chain, combining CVE-2021-42278 (sAMAccountName spoofing) and CVE-2021-42287 (KDC PAC confusion). It allows an authenticated standard domain user to escalate privileges to Domain Admin, potentially compromising the entire domain. It is designed for authorized red team exercises and penetration testing against vulnerable Active Directory environments.

This skill details the exploitation of the critical Zerologon vulnerability (CVE-2020-1472) found in the Microsoft Netlogon Remote Protocol. It allows an unauthenticated attacker to compromise a domain controller by resetting its machine account password. The guide covers the complete attack chain, including initial exploitation, credential dumping via DCSync, and subsequent privilege escalation in Active Directory environments. Used exclusively for authorized red teaming and security testing.