'lateral-movement' 검색 결과

Analyze Windows identity and host evidence in CTF sandboxes. Connect authentication tickets, credentials, mailbox rules, and host activity to explain which services accept access and how movement between hosts occurs.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Tracing authentication tickets and tokens
• Investigating mailbox rules alongside identity events
• Building a timeline of Windows host evidence

Hunt for lateral movement, where attackers move between networked systems, using Splunk searches. Connect Windows logins with process and network activity to identify unusual host relationships, trace movement paths, and document affected accounts and systems.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Tracing activity after credential theft
• Investigating unusual logins between hosts
• Finding new or unexpected host connections

Investigate attackers moving between internal systems by correlating login records with network traffic. Supports detection rules, suspicious SMB and RDP activity analysis, and reports showing attack timelines, affected hosts, and monitoring gaps.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating attacker movement across internal systems
• Creating rules for suspicious authentication patterns
• Tracing affected hosts after a PsExec alert

Investigate lateral movement, where attackers expand access across Azure identities and tenants. Correlate audit logs and unusual sign-ins, build Microsoft Sentinel detection queries, and report affected identities with recommended containment actions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious Azure sign-ins
• Building Microsoft Sentinel detection rules
• Reviewing suspicious OAuth app consent

Check industrial process data servers for unauthorized clients and suspicious data patterns using a Python detector. Provides alerts for missing or constant values and investigation checks for attackers moving between IT and operational technology networks.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking industrial historian servers for unauthorized clients
• Investigating missing or suspiciously constant process data
• Reviewing signs of movement between IT and OT networks

Analyze Zeek network logs to find lateral movement, when an intruder spreads between internal computers. Examine administrative file sharing, authentication across multiple hosts, and remote service operations to identify suspicious connections and reconstruct incident timelines.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Tracing spread to other computers after an initial compromise
• Investigating unauthorized transfers to administrative shares
• Finding one account authenticating to many internal hosts

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Active Directory, Kerberos, LDAP, OAuth, enterprise messaging, Windows host forensics, credential material, and lateral-movement challenges. Use when the user asks to trace tickets or tokens, inspect mailbox rules, analyze Windows host evidence, understand an AD trust path, or explain a lateral-movement chain across sandbox-linked nodes. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Execute commands and binaries on remote Windows systems utilizing PsExec and SMB/RPC mechanisms. This skill details the mechanics behind tools like Sysinternals PsExec, Impacket's psexec.py, and their role in lateral movement via hidden administrative shares.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Execute lateral movement within Microsoft Entra ID (formerly Azure AD) and Microsoft 365 environments. Use this skill to traverse cloud resources using compromised user tokens, managed identities, Primary Refresh Tokens (PRT), and application permissions (Service Principals) to achieve Global Administrator access.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Hunts for lateral movement via remote service creation, admin share writes, and remote WMI process creation by correlating Windows logon, service install, and process-creation events. Activates for requests to hunt lateral movement, detect PsExec/WMIexec activity, or find remote execution over SMB and WMI.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, NTLM account spray activity, remote service execution, and anomalous internal connections.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zeek, Velociraptor, and SIEM correlation rules to detect attackers moving between systems.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service abuse.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomaly correlation to identify privilege escalation, token theft, and cross-tenant pivoting.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

tespit etme
lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomaly correlation to identify privilege escalation, token theft, and cross-tenant pivoting.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service abuse.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, Pass-the-Hash activity, remote service execution, and anomalous internal connections.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zeek, Velociraptor, and SIEM correlation rules to detect attackers moving between systems.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomaly correlation to identify privilege escalation, token theft, and cross-tenant pivoting.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zeek, Velociraptor, and SIEM correlation rules to detect attackers moving between systems.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, NTLM account spray activity, remote service execution, and anomalous internal connections.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service abuse.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomaly correlation to identify privilege escalation, token theft, and cross-tenant pivoting.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use CloudFox to inspect AWS and Azure resources through read-only queries. Identify exposed endpoints, secrets, permissions, and role trust relationships, then organize findings into files for reviewing configuration weaknesses and potential paths to broader access.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inventorying an unfamiliar AWS or Azure account
• Finding internet-facing resources
• Mapping role trust relationships and permissions