Skill UI

This skill provides comprehensive methods for detecting and preventing privilege escalation within Kubernetes pods and containers. It details using runtime tools like Falco for monitoring syscalls and capabilities, and implementing admission controls via OPA Gatekeeper or Pod Security Admission to enforce security best practices, thereby hardening the cluster against unauthorized access and dangerous configurations.

This skill provides a methodology for proactive threat hunting to detect compromised service accounts. It focuses on identifying anomalous activities such as unusual interactive logons, unauthorized privilege escalation, lateral movement, and suspicious access patterns using SIEM/EDR platforms. Essential for incident response and compliance.

A comprehensive guide for threat hunting designed to detect various forms of privilege escalation abuse, including UAC bypass, setuid/setgid manipulation, and exploiting auto-elevating processes on Windows and Linux. It provides specific monitoring workflows, detection queries (Splunk, KQL, Sigma), and key indicators related to MITRE ATT&CK T1548.

This guide details the exploitation of the Active Directory Certificate Services (AD CS) ESC1 vulnerability. By leveraging misconfigurations, an attacker can request certificates impersonating high-privileged users (e.g., Domain Admins). The workflow covers AD enumeration, forging certificates with arbitrary Subject Alternative Names (SANs), authenticating via PKINIT, and ultimately escalating domain privileges using tools like mimikatz. Essential for authorized red team and penetration testing.

BloodHound is a powerful, graph-based reconnaissance tool specifically designed for Active Directory environments. It utilizes graph theory to map deep, hidden relationships and potential attack paths—such as privilege escalation chains—from compromised low-value accounts to high-value targets like Domain Admins. This tool is essential for authorized red team exercises and penetration testing engagements.

This skill details exploiting the noPac vulnerability chain, combining CVE-2021-42278 (sAMAccountName spoofing) and CVE-2021-42287 (KDC PAC confusion). It allows an authenticated standard domain user to escalate privileges to Domain Admin, potentially compromising the entire domain. It is designed for authorized red team exercises and penetration testing against vulnerable Active Directory environments.

This skill details the exploitation of the critical Zerologon vulnerability (CVE-2020-1472) found in the Microsoft Netlogon Remote Protocol. It allows an unauthenticated attacker to compromise a domain controller by resetting its machine account password. The guide covers the complete attack chain, including initial exploitation, credential dumping via DCSync, and subsequent privilege escalation in Active Directory environments. Used exclusively for authorized red teaming and security testing.

A comprehensive workflow for extracting, parsing, and analyzing Windows Event Logs (EVTX). It guides security professionals in using advanced tools like Chainsaw and Hayabusa, combined with Sigma rules, to detect critical security incidents such as lateral movement, privilege escalation, and persistence mechanisms during incident response and digital forensic investigations.

This guide provides comprehensive steps to harden the Docker daemon configuration. It covers essential security controls like user namespace remapping, disabling inter-container communication (ICC), implementing TLS authentication, and adopting rootless mode. Implementing these measures significantly reduces the attack surface and mitigates risks associated with container breakouts and privilege escalation, aligning with CIS benchmarks.

This skill provides a structured methodology for detecting process injection techniques (MITRE ATT&CK T1055), which adversaries use for defense evasion and privilege escalation. It analyzes granular security logs, specifically utilizing Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess), alongside source-target process relationship mapping to identify suspicious malicious behavior over general system activity.

IAM Permission Boundaries are an advanced AWS security feature used to set the maximum permissions an identity-based policy can grant to an IAM entity (user or role). This allows security teams to safely delegate role creation to developers while strictly enforcing least-privilege principles, preventing unintended privilege escalation.

A comprehensive guide on implementing AWS CloudTrail log analysis for robust security monitoring, threat detection, and forensic investigation. Learn how to configure CloudTrail, use Amazon Athena for SQL querying, and leverage CloudWatch Logs Insights and SIEM integration to identify unauthorized access, privilege escalation, and suspicious API activity across AWS services.