127건 · 관련도순
Analyze advanced persistent threat (APT) group techniques using MITRE ATT&CK Navigator to create layered heatmaps of adversary TTPs for detection gap analysis and threat-informed defense.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect WMI event subscription persistence by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Red team engagement planning is the foundational phase that defines scope, objectives, rules of engagement (ROE), threat model selection, and operational timelines before any offensive testing begins.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
BloodHound is a graph-based Active Directory reconnaissance tool that uses graph theory to reveal hidden and unintended relationships within AD environments. Red teams use BloodHound to identify attac
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
MS17-010 (EternalBlue) is a critical vulnerability in Microsoft's SMBv1 implementation that allows remote code execution. Originally discovered by the NSA and leaked by the Shadow Brokers in 2017, it
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect suspicious PowerShell execution patterns including encoded commands, download cradles, AMSI bypass attempts, and constrained language mode evasion.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect DLL side-loading attacks where adversaries place malicious DLLs alongside legitimate applications to hijack execution flow for defense evasion.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect malicious email forwarding rules created by adversaries to maintain persistent access to email communications for intelligence collection and BEC attacks.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated data theft.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service abuse.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect Mimikatz execution through command-line patterns, LSASS access signatures, binary indicators, and in-memory detection of known modules.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect Pass-the-Hash attacks by analyzing NTLM authentication patterns, identifying Type 3 logons with NTLM where Kerberos is expected, and correlating with credential dumping.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect privilege escalation attempts including token manipulation, UAC bypass, unquoted service paths, kernel exploits, and sudo/doas abuse across Windows and Linux.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect abuse of service accounts through anomalous interactive logons, privilege escalation, lateral movement, and unauthorized access patterns.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests targeting service accounts with SPNs for offline password cracking.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect process hollowing (T1055.012) by analyzing memory-mapped sections, hollowed process indicators, and parent-child process anomalies in EDR telemetry.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform for gathering, sharing, storing, and correlating Indicators of Compromise (IOCs) of targeted attacks, threat
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Plan and execute a comprehensive red team engagement covering reconnaissance through post-exploitation using MITRE ATT&CK-aligned TTPs to evaluate an organization's detection and response capabilities.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
This skill outlines methodologies for performing authorized penetration testing against AWS, Azure, and GCP cloud environments. It covers understanding the shared responsibility model for testing scope, leveraging cloud-specific attack tools like Pacu and ScoutSuite, exploiting IAM misconfigurations, testing for SSRF to cloud metadata services, and reporting findings aligned to MITRE ATT&CK Cloud matrix.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Building a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. T
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Builds a structured SOC incident response playbook for ransomware attacks covering detection, containment, eradication, and recovery phases with specific SIEM queries, isolation procedures, and decision trees. Use when SOC teams need formalized response procedures for ransomware incidents aligned to NIST SP 800-61 and MITRE ATT&CK ransomware techniques.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Spearphishing simulation is a targeted social engineering attack vector used by red teams to gain initial access. Unlike broad phishing campaigns, spearphishing uses OSINT-derived intelligence to craf
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Pass-the-Ticket (PtT) is a lateral movement technique that uses stolen Kerberos tickets (TGT or TGS) to authenticate to services without knowing the user's password. By extracting Kerberos tickets fro
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or perform forensic timeline analysis of Windows endpoints and domain controllers.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.