Skill UI

This skill provides comprehensive methods for collecting and synthesizing Open-Source Intelligence (OSINT) regarding threat actors, malicious infrastructure, and attack campaigns. It utilizes public data sources, passive reconnaissance tools (like WHOIS, Certificate Transparency), and specialized platforms (Maltego, Shodan, SpiderFoot) to map adversary context and perform pre-engagement intelligence gathering for authorized red team assessments. Emphasis is placed on passive collection techniques to ensure legality and operational security.

This technique abuses the Microsoft Directory Replication Service Remote Protocol (MS-DRSR) to impersonate a Domain Controller (DC). By exploiting replication rights (e.g., DS-Replication-Get-Changes-All), attackers can dump password hashes for critical accounts, such as KRBTGT and Domain Admins. The extracted hashes are used to forge Golden Tickets, achieving long-term, persistent domain access. This is a critical post-exploitation method used during authorized red team engagements.

Simulates advanced persistent threat (APT) activity across the entire cyber kill chain, from reconnaissance to data exfiltration. It evaluates an organization's detection, prevention, and response capabilities using MITRE ATT&CK-aligned techniques, moving beyond typical vulnerability scanning. Ideal for objective-based assessments and purple teaming.

Utilize BloodHound Community Edition to conduct deep internal Active Directory reconnaissance using graph theory. This skill maps complex relationships, including ACLs, group memberships, and trust links, to visualize potential attack paths. It is crucial in red-teaming engagements to identify the shortest path from a low-privileged foothold to high-value targets like Domain Admins, or to validate security hardening efforts.

This skill simulates Pass-the-Ticket (PtT) attacks, a critical post-exploitation technique. It involves dumping active Kerberos tickets (TGT/TGS) from memory (LSASS) on a compromised host and injecting them into another session. This allows an attacker to impersonate the ticket owner and perform lateral movement or escalate privileges without needing the user's password. Use exclusively for authorized red-teaming and security auditing.

This guide outlines the comprehensive process for planning and executing authorized vishing (voice phishing) pretext calls. Used in red teaming exercises, it assesses employee susceptibility to social engineering attacks and evaluates the effectiveness of existing security awareness controls. Key steps include OSINT research, developing believable pretexts (e.g., IT helpdesk impersonation), structured call execution, and collecting detailed metrics.

This guide details the end-to-end process of conducting a sophisticated spearphishing simulation campaign, mirroring real red team adversary techniques. It covers initial OSINT research and pretext development, building weaponized payloads that bypass security controls, setting up robust email infrastructure (SPF/DKIM/DMARC), executing the campaign in waves, and performing detailed post-campaign metrics analysis for comprehensive security reporting.

This tool deploys decoy canary files in critical system directories to provide early warning against ransomware attacks. Utilizing Python's watchdog library, it monitors for any read, modify, rename, or delete operations on these decoy files. Detection triggers immediate alerts via multiple channels (Email, Slack, Syslog), helping security teams identify and respond to malicious activity before full data encryption occurs. It serves as a crucial detection layer in a layered security defense.

A comprehensive guide providing detailed KQL and SPL detection queries for identifying potential abuse of Azure service principals within Microsoft Entra ID. This tool helps SOC analysts and security teams investigate complex threats like unauthorized credential addition, privileged role assignment, admin consent bypass, and enumeration, crucial for proactive threat hunting and incident response.

A comprehensive guide for security teams on detecting and responding to unauthorized crypto mining operations in cloud environments (AWS, Azure). It details a multi-layered approach, utilizing cost anomaly detection, compute utilization monitoring, GuardDuty findings, and network flow log analysis (VPC/KQL) to identify resource hijacking attempts and suspicious activity across EC2, ECS, and EKS workloads.

This skill provides structured procedures and Python examples for detecting internal data exfiltration. It analyzes endpoint, cloud, and email logs by establishing behavioral baselines and performing statistical anomaly detection. Use cases include investigating insider threats, monitoring DLP policy violations, and building robust User and Entity Behavior Analytics (UEBA) rules for SOC teams.

A comprehensive guide and workflow for detecting Mimikatz and similar credential-dumping activities. It utilizes command-line pattern matching, LSASS memory access signatures, binary indicators, and in-memory analysis. Ideal for threat hunting, scoping compromises during incident response, or validating detection coverage in purple team exercises using EDR/SIEM data.