Skill UI

Provides a catalog of Linux and Windows post-exploitation privilege escalation techniques, covering sudo/capability abuse, scheduled tasks, token impersonation, AD kerberoasting, credential harvesting, and tool recommendations for red teamers.

This guide details the methodology for conducting internal network penetration tests, simulating an attacker operating from an assumed breach state. It covers initial network reconnaissance, Active Directory enumeration, advanced credential harvesting techniques (e.g., Kerberoasting, Pass-the-Hash), and lateral movement exploitation to determine the full blast radius of a potential breach. Essential for comprehensive security auditing.

Implements Microsoft's Enhanced Security Admin Environment (ESAE) tiered administration model for Active Directory. This skill guides the hardening of AD privileged access architecture by establishing strict separation between Tier 0, Tier 1, and Tier 2 accounts. It is essential for mitigating advanced threats like pass-the-hash, Kerberoasting, and ensuring compliance with industry standards (NIST 800-53).

A comprehensive guide for detecting Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests (Event ID 4769). This technique targets service accounts with Service Principal Names (SPNs), which are requested offline by attackers to crack service account passwords. Use this during threat hunting or incident response to scope MITRE T1558 credential access activities in Active Directory environments.

Executes authorized, advanced attack simulations against Active Directory environments to identify critical misconfigurations, weak credentials, and exploitable trust relationships. Utilizing industry tools like BloodHound, Mimikatz, and Impacket, this process simulates complex attacks such as Kerberoasting, Golden Ticket forging, and domain compromise path analysis, helping organizations validate their security posture against real-world threats.

Kerberoasting is a credential access attack (T1558.003) targeting Active Directory service accounts with Service Principal Names (SPNs). This skill demonstrates using Impacket to request Kerberos TGS tickets for these accounts. The resulting RC4 or AES-encrypted tickets are then cracked offline using tools like Hashcat or John the Ripper, allowing attackers to recover service account credentials for lateral movement during authorized penetration testing or red-team engagements.

This comprehensive guide details the methodology for Active Directory (AD) penetration testing. It covers deep domain enumeration, utilizing tools like BloodHound and Impacket, and executing advanced attacks such as Kerberoasting, AS-REP Roasting, and privilege escalation via delegation abuse. Use this when conducting authorized security assessments to discover and exploit misconfigurations to achieve domain compromise.

Kerberoasting is a post-exploitation technique used in Active Directory environments. It targets service accounts by requesting encrypted Kerberos TGS tickets for accounts with Service Principal Names (SPNs). These tickets are then cracked offline using tools like hashcat to recover the service account's NTLM credentials. This skill is intended only for authorized red team engagements and penetration testing to assess AD privilege escalation risks.

This tool automates the deployment of deception-based honeytokens within Active Directory environments. It creates fake privileged accounts, decoy SPNs for Kerberoasting detection, and misleading GPOs with password traps. Designed for advanced security teams to detect reconnaissance, lateral movement, and credential theft with high fidelity.

A comprehensive guide covering advanced Kerberos attacks against Active Directory environments. Techniques include AS-REP roasting, Kerberoasting, forging golden, silver, diamond, and sapphire tickets, and exploiting delegation abuse. Designed for penetration testers and red teams to simulate sophisticated domain compromise scenarios.