Skill UI

Simulates advanced persistent threat (APT) activity across the entire cyber kill chain, from reconnaissance to data exfiltration. It evaluates an organization's detection, prevention, and response capabilities using MITRE ATT&CK-aligned techniques, moving beyond typical vulnerability scanning. Ideal for objective-based assessments and purple teaming.

A comprehensive guide and workflow for detecting Mimikatz and similar credential-dumping activities. It utilizes command-line pattern matching, LSASS memory access signatures, binary indicators, and in-memory analysis. Ideal for threat hunting, scoping compromises during incident response, or validating detection coverage in purple team exercises using EDR/SIEM data.

This guide details how to hunt for DCSync attacks (MITRE ATT&CK T1003.006) in Active Directory environments. It focuses on analyzing Windows Security Event ID 4662, specifically looking for DS-Replication-Get-Changes requests originating from non-domain-controller accounts. This technique is critical for incident response, purple teaming, and detecting unauthorized credential theft via Active Directory replication abuse.

This skill guides Security Operations Center (SOC) teams through structured threat modeling using the MITRE ATT&CK framework. It enables mapping adversary Tactics, Techniques, and Procedures (TTPs) against organizational assets to identify critical detection coverage gaps, prioritize defensive investments, and improve overall security posture. Ideal for risk assessment, purple teaming, and compliance planning.

This skill guides the execution of structured purple team exercises, simulating real-world adversary techniques (Red Team) and validating the effectiveness of existing detection rules and controls (Blue Team). It is essential for Security Operations Center (SOC) teams to identify critical detection gaps, optimize analyst response playbooks, and enhance the overall security posture against specific threat actors mapped to MITRE ATT&CK techniques.

This framework executes sophisticated threat emulation tests using Atomic Red Team, mapping directly to MITRE ATT&CK techniques. It allows security teams to actively simulate adversary behavior, validating the detection coverage of SIEM rules and EDR controls. Use this tool for comprehensive purple team operations, penetration testing, and security auditing.

This skill provides comprehensive detection strategies for adversaries abusing DCOM objects (e.g., MMC20.Application) to perform stealthy lateral movement (MITRE ATT&CK T1021.003). It details how to correlate Sysmon Event IDs (Process Creation, Network Connection), analyze WMI activity, and monitor RPC traffic on port 135 to identify unauthorized remote command execution chains. Ideal for advanced threat hunting, red teaming, and purple team exercises.

This utility executes atomic Red Team tests mapped to the MITRE ATT&CK framework. It is essential for purple team exercises, allowing security teams to assess detection coverage gaps, validate SIEM/EDR rules, and generate detailed ATT&CK coverage heatmaps. Use it to build continuous detection validation loops and measure blue team visibility against known adversary techniques.

Stratus Red Team is an open-source tool for detection engineering and purple teaming. It atomistically detonates granular, MITRE ATT&CK-mapped offensive techniques across AWS, Azure, GCP, and Kubernetes. The tool executes a full, repeatable lifecycle (warmup, detonate, revert, cleanup) to generate realistic attacker telemetry. Use it to validate if cloud security tools (like CloudTrail or Sentinel) reliably trigger on simulated attacks, or to safely practice red teaming.

Sliver is an open-source, cross-platform Command and Control (C2) framework used for adversary emulation in authorized red-team engagements. This skill guides users through deploying the C2 server, establishing multi-protocol listeners (mTLS, DNS, HTTPS), generating cross-platform implants, and executing advanced post-exploitation techniques, including pivoting and in-memory execution via the Armory.