Skill UI

This skill provides advanced detection methods for credential dumping, covering LSASS memory access, SAM hive extraction, and NTDS.dit theft (e.g., using Mimikatz). It utilizes Sysmon Event ID 10 and Windows Security logs to enable threat hunting, assisting SOC analysts in triaging EDR alerts and building robust SIEM correlation rules.

This specialized skill is designed for deep forensic analysis in complex Windows environments, crucial for CTF and red teaming. It traces identity flows, including Active Directory (AD) origins, Kerberos ticket lifecycles, and OAuth authorization claims. Use it to correlate host artifacts (LSA, DPAPI, Sysmon) with identity evidence to map complete lateral movement and privilege escalation chains.