Skill UI

This guide details comprehensive detection methods for DCSync attacks (MITRE T1003.006) in Active Directory. Attackers abuse legitimate directory replication protocols to extract sensitive password hashes. Detection relies on auditing Windows Event ID 4662 for unauthorized access attempts to critical Directory Service GUIDs, specifically flagging non-domain-controller accounts attempting replication calls. Essential for threat hunting and incident response.

A comprehensive guide for advanced threat hunting, focusing on detecting DLL side-loading and search-order hijacking (MITRE T1574). It instructs users to analyze Sysmon Event ID 7 logs, validate file signatures and hashes, and identify path anomalies to uncover APT persistence mechanisms. Essential for incident response and proactive threat detection in enterprise environments.

This skill provides methods for detecting covert data exfiltration channels using DNS tunneling. It analyzes DNS query patterns, including subdomain entropy, query volume anomalies, oversized TXT/CNAME records, and unusual query types, to identify potential data leakage attempts from compromised networks. Ideal for threat hunting and building advanced passive DNS monitoring capabilities.

This guide is designed for threat hunting, helping security teams proactively detect persistent unauthorized access methods. It focuses on identifying malicious inbox/mail-flow forwarding rules that adversaries establish after a compromise to maintain access to corporate communications, often associated with Business Email Compromise (BEC) or T1114 techniques. Use during incident response and proactive security assessments.

This skill provides comprehensive detection rules for advanced defense evasion techniques used by adversaries, including log tampering (T1070), timestomping, process injection (T1055), and disabling security tools (T1562). It is ideal for threat hunting, building detection rules, and investigating stealthy attacker activity using Sysmon and SIEM data.

Provides advanced techniques for detecting fileless malware that operates entirely in memory or abuses legitimate system binaries (LOLBins). It analyzes WMI persistence, registry-resident payloads, and common abuse patterns of tools like PowerShell, mshta, and certutil, crucial for advanced threat hunting and forensic investigations.

A detailed guide and set of queries for detecting Golden Ticket attacks in Active Directory environments. This methodology analyzes Kerberos TGT anomalies, including mismatched encryption types (e.g., RC4 in AES-only domains), impossible ticket lifetimes, and TGS requests lacking prior TGTs. Use this during threat hunting or post-breach assessment when the KRBTGT account hash may be compromised.

Utilizes SIEM platforms (Splunk/Elastic) and Windows Event Log analysis (ID 4769) to detect indicators of Golden Ticket attacks. This skill analyzes Kerberos logs for specific anomalies such as RC4 encryption downgrades, abnormal ticket lifetimes, and correlation failures between TGT and TGS requests, crucial for advanced threat hunting in Active Directory environments.

This guide provides a structured methodology for proactively detecting and hunting various insider threat behaviors. It focuses on identifying indicators such as unusual data access, off-hours activity, mass file downloads, and privilege misuse. It is crucial for threat-hunting during incident response or investigating departed employees for potential data theft.

A comprehensive guide for detecting Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests (Event ID 4769). This technique targets service accounts with Service Principal Names (SPNs), which are requested offline by attackers to crack service account passwords. Use this during threat hunting or incident response to scope MITRE T1558 credential access activities in Active Directory environments.

This skill focuses on advanced threat detection techniques used to identify the abuse of legitimate Windows binaries (LOLBins) for malicious purposes. It requires monitoring process creation, command-line arguments, and network activity to pinpoint fileless and living-off-the-land attacks. Ideal for building SIEM/EDR detection rules, threat hunting, and hardening endpoint security policies.

This skill provides a comprehensive methodology for detecting Living Off the Land Binaries (LOLBAS) abuse. It analyzes process telemetry (Sysmon, Windows Logs) and parent-child relationships to identify when attackers misuse legitimate Windows utilities (like certutil, mshta, rundll32) to execute malicious code while bypassing traditional security detection. Essential for threat hunting and advanced incident response.