Skill UI

Utilizes structured critical reasoning to rigorously stress-test ideas, plans, and decisions. This skill allows you to play devil's advocate, conduct pre-mortems, execute red-teaming exercises, or audit underlying assumptions. It employs multiple advanced modes, including Socratic questioning, Hegelian dialectics, and Falsificationism, to identify blind spots, weaknesses, and unstated assumptions before commitment.

Details the deployment, hardening, and operation of a resilient Command and Control (C2) infrastructure using the open-source Sliver framework. This guide covers advanced techniques including multi-protocol listeners (mTLS, HTTP/S, DNS, WireGuard), deployable redirectors, and domain fronting, making it essential for authorized red-teaming and sophisticated adversary simulation.

Simulates advanced persistent threat (APT) activity across the entire cyber kill chain, from reconnaissance to data exfiltration. It evaluates an organization's detection, prevention, and response capabilities using MITRE ATT&CK-aligned techniques, moving beyond typical vulnerability scanning. Ideal for objective-based assessments and purple teaming.

Utilize BloodHound Community Edition to conduct deep internal Active Directory reconnaissance using graph theory. This skill maps complex relationships, including ACLs, group memberships, and trust links, to visualize potential attack paths. It is crucial in red-teaming engagements to identify the shortest path from a low-privileged foothold to high-value targets like Domain Admins, or to validate security hardening efforts.

This skill simulates Pass-the-Ticket (PtT) attacks, a critical post-exploitation technique. It involves dumping active Kerberos tickets (TGT/TGS) from memory (LSASS) on a compromised host and injecting them into another session. This allows an attacker to impersonate the ticket owner and perform lateral movement or escalate privileges without needing the user's password. Use exclusively for authorized red-teaming and security auditing.

This guide outlines the comprehensive process for planning and executing authorized vishing (voice phishing) pretext calls. Used in red teaming exercises, it assesses employee susceptibility to social engineering attacks and evaluates the effectiveness of existing security awareness controls. Key steps include OSINT research, developing believable pretexts (e.g., IT helpdesk impersonation), structured call execution, and collecting detailed metrics.

This guide details the detection and exploitation of the critical MS17-010 (EternalBlue) vulnerability in SMBv1. It covers the full red-teaming lifecycle, including vulnerability scanning using Nmap and executing payloads via Metasploit. It is designed for authorized penetration testing and simulated adversary engagements against legacy Windows environments.

This guide details the exploitation chain for noPac, combining CVE-2021-42278 (sAMAccountName spoofing) and CVE-2021-42287 (KDC PAC confusion). It demonstrates how an attacker can escalate from a standard domain user to Domain Admin by manipulating Active Directory tickets and performing DCSync. Primarily used in authorized red-teaming and penetration testing to validate domain security.

This guide details the exploitation of the critical Zerologon vulnerability (CVE-2020-1472) in Active Directory Domain Controllers. It demonstrates the methodology for resetting the DC machine account password to empty, achieving full domain compromise. Subsequent steps include dumping domain credentials using DCSync. Essential for authorized red-teaming and security validation.

This guide details how to hunt for DCSync attacks (MITRE ATT&CK T1003.006) in Active Directory environments. It focuses on analyzing Windows Security Event ID 4662, specifically looking for DS-Replication-Get-Changes requests originating from non-domain-controller accounts. This technique is critical for incident response, purple teaming, and detecting unauthorized credential theft via Active Directory replication abuse.

This skill guides Security Operations Center (SOC) teams through structured threat modeling using the MITRE ATT&CK framework. It enables mapping adversary Tactics, Techniques, and Procedures (TTPs) against organizational assets to identify critical detection coverage gaps, prioritize defensive investments, and improve overall security posture. Ideal for risk assessment, purple teaming, and compliance planning.

This guide details the process of performing Active Directory reconnaissance using BloodHound and SharpHound. It leverages graph theory to visualize hidden trust relationships, group memberships, and ACLs, mapping the shortest attack paths from a low-privilege compromised user all the way to Domain Admin rights. This is essential for red-teaming, security auditing, and identifying critical misconfigurations.