111건 · 관련도순
Detect Golden Ticket attacks in Active Directory by analyzing Kerberos TGT anomalies including mismatched encryption types, impossible ticket lifetimes, non-existent accounts, and forged PAC signatures in domain controller event logs.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns in Splunk and Elastic SIEM
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect NTLM relay attacks through Windows Security Event correlation by analyzing Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, auditing SMB and LDAP signing enforcement across the domain, and detecting NTLM downgrade attacks from NTLMv2 to NTLMv1 using event log analysis.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect Kerberos Golden Ticket forgery by analyzing Windows Event ID 4769 for RC4 encryption downgrades (0x17), abnormal ticket lifetimes, and krbtgt account anomalies in Splunk and Elastic SIEM
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft using Sysmon Event ID 10, Windows Security logs, and SIEM correlation rules
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Conduct internal Active Directory reconnaissance using BloodHound Community Edition to map attack paths, identify privilege escalation chains, and discover misconfigurations in domain environments.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Perform DCSync attacks to replicate Active Directory credentials and establish domain persistence by extracting KRBTGT, Domain Admin, and service account hashes for Golden Ticket creation.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Trigger machine account authentication with PetitPotam (MS-EFSR) and Coercer across MS-RPRN, MS-DFSNM, and MS-FSRVP to feed NTLM relay into AD CS Web Enrollment (ESC8) and other relay targets.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or perform forensic timeline analysis of Windows endpoints and domain controllers.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Extract DPAPI-protected secrets such as credentials and browser data offline and online.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Audit, detect, and remediate Shadow Credentials misconfigurations on msDS-KeyCredentialLink in Active Directory. Focuses on access-controls, monitoring Event ID 5136, and credential-management hygiene.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and doma
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", ...
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Expert en infrastructure Azure (AKS, Functions, Cosmos DB, AD, ARM templates, cost optimization)
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect Golden Ticket attacks in Active Directory by analyzing Kerberos TGT anomalies including mismatched encryption types, impossible ticket lifetimes, non-existent accounts, and forged PAC signatures in domain controller event logs.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns in Splunk and Elastic SIEM
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect NTLM relay attacks through Windows Security Event correlation by analyzing Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, auditing SMB and LDAP signing enforcement across the domain, and detecting NTLM downgrade attacks from NTLMv2 to NTLMv1 using event log analysis.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect Kerberos Golden Ticket forgery by analyzing Windows Event ID 4769 for RC4 encryption downgrades (0x17), abnormal ticket lifetimes, and krbtgt account anomalies in Splunk and Elastic SIEM
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft using Sysmon Event ID 10, Windows Security logs, and SIEM correlation rules
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Conduct internal Active Directory reconnaissance using BloodHound Community Edition to map attack paths, identify privilege escalation chains, and discover misconfigurations in domain environments.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Perform DCSync attacks to replicate Active Directory credentials and establish domain persistence by extracting KRBTGT, Domain Admin, and service account hashes for Golden Ticket creation.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or perform forensic timeline analysis of Windows endpoints and domain controllers.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.