Skill UI

Utilizes User and Entity Behavior Analytics (UEBA), statistical baselines, and machine learning models to monitor authentication logs. This skill identifies sophisticated security threats such as impossible travel, credential stuffing, brute force attacks, and compromised accounts in real-time. Essential for security operations and identity access management.

This guide details methods for detecting and mitigating OAuth token theft and replay attacks in cloud environments, specifically targeting Microsoft Entra ID (Azure AD). It covers protection against access token theft, Primary Refresh Token (PRT) abuse, and pass-the-cookie attacks. Users can leverage Conditional Access and Token Protection features to cryptographically bind tokens to devices, significantly enhancing cloud identity security and preventing session hijacking.

This platform deploys continuous attack graph analysis to map how adversaries can chain together various exposures—including vulnerabilities, misconfigurations, identity risks, and credential weaknesses—toward critical business assets. It pinpoints 'choke points,' allowing security teams to prioritize remediation efforts for maximum risk reduction with minimal effort, ideal for CTEM programs.

This guide details the implementation of advanced, phishing-resistant, passwordless authentication using Microsoft Entra ID. It covers configuring FIDO2 security keys, Windows Hello for Business, and passkey support via Microsoft Authenticator. Use this skill to eliminate reliance on passwords, mitigate credential stuffing attacks, and satisfy strict regulatory mandates for modern identity access management.

Offensive cloud security methodology for AWS, Azure, and GCP. Covers identity discovery, credential harvesting, enumeration, privilege escalation, persistence, data exfiltration, lateral movement, serverless abuse, Kubernetes paths, and detection evasion during authorized assessments.

A powerful offensive suite for authorized red-teaming of Microsoft Entra ID (Azure AD). ROADtools combines ROADrecon for comprehensive directory enumeration (users, groups, policies, apps) and an offline GUI, with roadtx for advanced token acquisition, exchange, and Primary Refresh Token (PRT) abuse. It covers the full scope of cloud identity discovery and token-based attacks against highly regulated tenants.

This guide details using the comprehensive AADInternals PowerShell toolkit for defensive validation of Microsoft Entra ID, Azure AD, and AD FS environments. It covers unauthenticated tenant reconnaissance, acquiring access tokens for multiple Microsoft APIs, and critically, testing for federation backdoors (Golden SAML) by simulating advanced attack techniques (MITRE T1606.002). It is designed for authorized red-team assessments to map external attack surfaces and validate identity infrastructure hardening.

A comprehensive tool for authorized red-team engagements, designed to map complex on-prem Active Directory and cloud Entra ID attack paths. It uses SharpHound and AzureHound to collect rich data, ingesting it into BloodHound CE for analysis using built-in queries and custom Cypher. Effectively identifies privilege escalation chains leading to domain or tenant compromise, especially in hybrid identity environments.

This skill provides methods to verify artifact signatures and SLSA provenance using tools like cosign and slsa-verifier. It is crucial for building secure CI/CD pipelines, detecting supply-chain attacks (e.g., tampering, compromised builds), and ensuring that deployed artifacts originate from trusted sources and build environments. Key features include enforcing keyless OIDC identity pinning and validating SLSA Build Levels.