46 skills · sorted by relevance
Investigate suspicious PowerShell activity using endpoint monitoring data and security logs. Examine encoded commands, downloads, and attempts to evade inspection, then document evidence, affected systems, risk, and recommended response actions.
Investigate process hollowing, where malicious code replaces a legitimate process in memory. Compare memory with disk files, examine process relationships, and correlate network activity to document suspicious processes and guide containment.
Investigate attempts to gain higher privileges on Windows and Linux using endpoint and security logs. Guide hypothesis testing, evidence analysis, false-positive checks, and reporting to help assess suspicious privilege changes and the scope of a compromise.
Investigate signs of Mimikatz credential theft using command lines, access to Windows authentication memory, file indicators, and known modules in memory. Correlate endpoint and security logs to assess suspicious alerts, document evidence, and recommend response actions.
Investigate service account misuse by examining unexpected interactive logons, privilege changes, and movement between systems. Correlate endpoint and security logs, distinguish suspicious activity from legitimate operations, and document evidence, risk, and recommended responses.
Investigate Pass-the-Hash attacks, where stolen password hashes are reused for authentication. Examine unusual NTLM logins alongside credential theft indicators, validate suspicious findings across security logs, and document evidence, affected hosts, confidence, and recommended responses.
Investigate Kerberoasting, an attack that targets service account passwords, using Active Directory authentication logs. Examine unusual service ticket requests, correlate endpoint and network evidence, and organize findings with risk levels and recommended response actions.
Investigate possible insider threats by correlating endpoint and security logs. Examine unusual data access, off-hours activity, bulk downloads, and privilege abuse, then document supporting evidence, risk, confidence, and recommended actions after checking the context for false positives.
Investigate attacks that make legitimate Windows applications load malicious DLL files. This skill examines loading events, digital signatures, file hashes, and unusual locations, then checks process behavior to document suspicious cases and guide remediation.
Investigate suspicious email forwarding and hidden inbox rules that may expose messages after an account compromise. The skill guides log analysis, validation, and reporting, helping analysts document evidence, assess risk, and recommend response actions.
Hunt for lateral movement, where attackers move between networked systems, using Splunk searches. Connect Windows logins with process and network activity to identify unusual host relationships, trace movement paths, and document affected accounts and systems.
Turn threat intelligence and detection gaps into testable investigation hypotheses. Use endpoint monitoring and security log queries to examine evidence, validate findings, connect related activity, and document risks and recommended actions in a consistent hunt report.
Detect privilege escalation attempts including token manipulation, UAC bypass, unquoted service paths, kernel exploits, and sudo/doas abuse across Windows and Linux.
The English summary is being prepared. Showing the original description.
Detect abuse of service accounts through anomalous interactive logons, privilege escalation, lateral movement, and unauthorized access patterns.
The English summary is being prepared. Showing the original description.
Detect process hollowing (T1055.012) by analyzing memory-mapped sections, hollowed process indicators, and parent-child process anomalies in EDR telemetry.
The English summary is being prepared. Showing the original description.
Detect Pass-the-Hash attacks by analyzing NTLM authentication patterns, identifying Type 3 logons with NTLM where Kerberos is expected, and correlating with credential dumping.
The English summary is being prepared. Showing the original description.
Detect Mimikatz execution through command-line patterns, LSASS access signatures, binary indicators, and in-memory detection of known modules.
The English summary is being prepared. Showing the original description.
Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service abuse.
The English summary is being prepared. Showing the original description.
Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests targeting service accounts with SPNs for offline password cracking.
The English summary is being prepared. Showing the original description.
Detect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated data theft.
The English summary is being prepared. Showing the original description.
Detect DLL side-loading attacks where adversaries place malicious DLLs alongside legitimate applications to hijack execution flow for defense evasion.
The English summary is being prepared. Showing the original description.
Detect malicious email forwarding rules created by adversaries to maintain persistent access to email communications for intelligence collection and BEC attacks.
The English summary is being prepared. Showing the original description.
Build a systematic threat hunt hypothesis framework that transforms threat intelligence, attack patterns, and environmental data into testable hunting hypotheses.
The English summary is being prepared. Showing the original description.
Detect Pass-the-Hash attacks by analyzing NTLM authentication patterns, identifying Type 3 logons with NTLM where Kerberos is expected, and correlating with credential dumping.
The English summary is being prepared. Showing the original description.