Skill UI

This skill provides comprehensive guidance and detection rules for identifying fileless malware, in-memory attacks, and living-off-the-land techniques. It covers detecting PowerShell exploitation, reflective DLL injection, WMI abuse, and registry-resident threats, enabling security teams to build robust detections when traditional antivirus fails.

Provides advanced techniques for detecting fileless malware that operates entirely in memory or abuses legitimate system binaries (LOLBins). It analyzes WMI persistence, registry-resident payloads, and common abuse patterns of tools like PowerShell, mshta, and certutil, crucial for advanced threat hunting and forensic investigations.

A comprehensive guide for threat hunters and incident responders to detect WMI-based persistence mechanisms (MITRE T1546.003). It details the analysis of Sysmon Event IDs 19, 20, and 21, cross-referencing these events with root\subscription namespaces and using tools like Autoruns and SIEM analysis for robust detection.

This tool analyzes Windows Event Logs (ID 4688, Sysmon ID 1) and WMI-Activity Operational events to detect suspicious lateral movement. It specifically hunts for WmiPrvSE.exe spawning child processes (like cmd.exe or powershell.exe) or identifying WMI event subscriptions, which are common indicators of remote code execution and persistence.

This comprehensive guide outlines a structured methodology for threat hunting and incident response, focusing on identifying adversary persistence mechanisms across Windows endpoints. It covers critical areas such as Registry Run/RunOnce keys, services, scheduled tasks, WMI event subscriptions, and COM hijacking. Use this workflow to proactively detect unauthorized backdoors, strengthen detection rules, and assess overall security posture against MITRE ATT&CK techniques (T1547).

This method targets fileless and trigger-based persistence mechanisms on Windows hosts by monitoring WMI event subscriptions (MITRE T1546.003). It hunts for suspicious activity involving WMI Event Filters, Consumers, and Bindings, which are critical indicators during advanced threat hunting and incident response when standard persistence locations are clean.

A comprehensive guide for security professionals to proactively hunt for Indicators of Compromise related to Volume Shadow Copy deletion (T1490). This technique is critical for detecting ransomware preparation and anti-forensics activity. It details using SIEM/EDR platforms to query for specific commands (vssadmin, wmic, PowerShell) associated with deleting system recovery points and shadow copies.

Monitors Windows process creation events to flag Living Off The Land Binary abuse by matching Event ID 4688/Sysmon 1 logs against LOLBAS database entries, supporting threat hunting and SIEM rule creation for fileless attacks.

This guide provides comprehensive steps for deploying and configuring the Rapid7 InsightVM platform. It covers setting up the Security Console, deploying distributed Scan Engines, configuring various scan templates (e.g., CIS Policy, PCI ASV), and implementing deep credentialed scanning using WMI/SMB for thorough vulnerability visibility across enterprise environments. Use this when building robust security architectures or achieving compliance.

This skill covers performing comprehensive vulnerability assessments across diverse environments, including on-premises infrastructure, cloud VMs, and container registries. It leverages standard network protocols like SSH (Linux) and WMI (Windows), coupled with advanced cloud provider APIs for analyzing disk snapshots without requiring local endpoint agents. Ideal for security auditing and compliance checks.

A comprehensive skill for Security Operations Center (SOC) teams and incident responders. It detects advanced lateral movement techniques, including Pass-the-Hash, PsExec, WMI, and RDP pivoting, by correlating Windows Security logs, Sysmon data, and network flow records within a SIEM. This capability is mapped to MITRE ATT&CK TA0008 and is essential for tracking an attacker's internal progression after initial compromise. Not intended for external attack detection.

This skill details advanced techniques for performing stealthy lateral movement across Windows domains using Windows Management Instrumentation (WMI). It covers the abuse of native tools like Impacket's wmiexec.py and CrackMapExec, enabling remote command execution, Pass-the-Hash attacks, and fileless techniques, crucial for authorized red team engagements and security auditing.