Skill UI

BloodHound is a powerful, graph-based reconnaissance tool specifically designed for Active Directory environments. It utilizes graph theory to map deep, hidden relationships and potential attack paths—such as privilege escalation chains—from compromised low-value accounts to high-value targets like Domain Admins. This tool is essential for authorized red team exercises and penetration testing engagements.

Details techniques for exploiting misconfigured Kerberos Constrained Delegation (KCD) in Active Directory. By abusing the S4U2Self and S4U2Proxy protocols, attackers can impersonate highly privileged users (e.g., Domain Admins) to achieve lateral movement or full domain compromise during authorized red-team engagements.

This guide details the exploitation of the critical Zerologon vulnerability (CVE-2020-1472) in Active Directory Domain Controllers. It demonstrates the methodology for resetting the DC machine account password to empty, achieving full domain compromise. Subsequent steps include dumping domain credentials using DCSync. Essential for authorized red-teaming and security validation.

This utility performs comprehensive forensic analysis on memory dumps. It leverages industry-standard tools like Volatility and Mimikatz to extract sensitive information, including cached credentials, NTLM/LM hashes, Kerberos tickets, and authentication tokens. It is crucial for incident response, assessing the scope of credential compromise, and investigating lateral movement attacks.

A comprehensive toolkit designed to automatically extract Indicators of Compromise (IOCs) from malware samples. It harvests critical artifacts including file hashes (MD5, SHA256), network indicators (IPs, domains, URLs), and host artifacts (registry keys, mutexes) using static, dynamic, and PCAP analysis. Essential for threat intelligence, building defense rules (YARA, Snort), and incident response.

This skill provides a systematic methodology for detecting Command and Control (C2) beaconing patterns in network traffic. It utilizes advanced statistical techniques, including Coefficient of Variation (CV) and jitter analysis, applied to network flow logs (Zeek, proxy, firewall). It is crucial for proactive threat hunting and incident response to identify compromised endpoints communicating periodically with malicious infrastructure.

This capability provides advanced threat hunting by analyzing network telemetry (DNS, proxy, connection logs) to detect Command and Control (C2) beaconing patterns. It uses statistical analysis, frequency detection, and jitter analysis to identify compromised endpoints communicating with adversary infrastructure, crucial for proactive threat detection and incident response.

This skill guides proactive security auditing and threat hunting for registry-based persistence artifacts (MITRE T1547) in Windows environments. It focuses on identifying mechanisms such as Run/RunOnce keys, Winlogon modifications, IFEO debugger injection, and COM hijacking to detect malware autostart techniques and scope compromises during incident response.

A comprehensive guide for security professionals to proactively hunt for Indicators of Compromise related to Volume Shadow Copy deletion (T1490). This technique is critical for detecting ransomware preparation and anti-forensics activity. It details using SIEM/EDR platforms to query for specific commands (vssadmin, wmic, PowerShell) associated with deleting system recovery points and shadow copies.

A comprehensive guide for conducting hypothesis-driven threat hunting against supply chain compromises (T1195). This skill focuses on querying SIEM/EDR logs to detect indicators of trojanized software updates, compromised dependencies, unauthorized code modifications, and tampered build artifacts. It is crucial when investigating suspected vendor compromises or scoping a build pipeline breach, requiring advanced knowledge of logging systems and threat intelligence.

A comprehensive threat hunting guide designed to detect adversary persistence and execution mechanisms hidden within Windows scheduled tasks (T1053.005). This skill analyzes Security Event ID 4698, suspicious task properties, and unusual execution patterns from tools like schtasks.exe. It is vital for incident response, proactive threat hunting, and enumerating persistence on compromised endpoints.

This skill performs threat hunting for persistence mechanisms by parsing Windows System event logs (Event ID 7045). It specifically detects suspicious service installations, analyzing service binary paths, and correlating these events with advanced telemetry (Sysmon/EDR) to identify indicators of compromise (MITRE ATT&CK T1543.003). Ideal for incident response and security validation.