'smb' 검색 결과

Investigate NTLM relay, an attack that forwards authentication messages to another service, by comparing Windows login events with host inventories. Use the supplied queries and audits to identify suspicious sources, weaker authentication, and gaps in signing enforcement.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating mismatched login source addresses and hostnames
• Building SIEM rules to detect NTLM relay
• Auditing SMB and LDAP signing requirements

Analyze Zeek network logs to find lateral movement, when an intruder spreads between internal computers. Examine administrative file sharing, authentication across multiple hosts, and remote service operations to identify suspicious connections and reconstruct incident timelines.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Tracing spread to other computers after an initial compromise
• Investigating unauthorized transfers to administrative shares
• Finding one account authenticating to many internal hosts

Trace movement between Windows hosts in a CTF sandbox using credentials and Kerberos tickets, which carry authentication information. Connect recovered artifacts to the service that accepted them and document the resulting access or privileges.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Trace movement between Windows hosts
• Identify services that accept recovered credentials
• Connect Kerberos tickets to resulting access

Helps plan NetExec commands for penetration testing in Active Directory, the system used to manage Windows domain accounts. Covers authentication checks, shared resources, permissions, and information collection with examples organized by network protocol.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking NetExec authentication options
• Enumerating domain users and shared resources
• Collecting data for BloodHound

Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, NTLM account spray activity, remote service execution, and anomalous internal connections.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, Pass-the-Hash activity, remote service execution, and anomalous internal connections.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, NTLM account spray activity, remote service execution, and anomalous internal connections.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Hunt for lateral movement, where attackers move between networked systems, using Splunk searches. Connect Windows logins with process and network activity to identify unusual host relationships, trace movement paths, and document affected accounts and systems.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Tracing activity after credential theft
• Investigating unusual logins between hosts
• Finding new or unexpected host connections

Investigate attackers moving between internal systems by correlating login records with network traffic. Supports detection rules, suspicious SMB and RDP activity analysis, and reports showing attack timelines, affected hosts, and monitoring gaps.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating attacker movement across internal systems
• Creating rules for suspicious authentication patterns
• Tracing affected hosts after a PsExec alert

Azure File Share JavaScript/TypeScript SDK (@azure/storage-file-share) for SMB file share operations. Use for creating shares, managing directories, uploading/downloading files, and handling file metadata. Supports Azure Files SMB protocol scenarios. Triggers: "file share", "@azure/storage-file-share", "ShareServiceClient", "ShareClient", "SMB", "Azure Files".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Execute advanced Man-in-the-Middle (MITM) NTLM Relay attacks specifically targeting environments where SMB Signing is purportedly enabled but improperly configured (e.g., exclusively required on Domain Controllers but NOT enforced universally on standard Workstations or File Servers). Utilize powerful tools like Responder and Impacket's NTLMRelayX to coercively capture NTLMv2 authentications (via LLMNR, WPAD, or Coercion methods like PetitPotam) and seamlessly relay them across the network identically yielding immediate Local Administrator command execution.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Active Directory and network lateral movement assessment. Pass-the-hash, pass-the-ticket, Kerberoasting, AS-REP roasting, NTLM relay, SMB relay, WMI/WinRM/PSRemoting abuse, constrained/unconstrained delegation, RBCD, cross-trust exploitation, and pivoting. Uses impacket, netexec, enum4linux-ng, smbmap, smbclient, bloodhound-python, Responder, ntlmrelayx, mitm6, and ldap-utils. Chains from /post-exploit or /credential-audit.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Hunts for lateral movement via remote service creation, admin share writes, and remote WMI process creation by correlating Windows logon, service install, and process-creation events. Activates for requests to hunt lateral movement, detect PsExec/WMIexec activity, or find remote execution over SMB and WMI.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Recommends CGM over SMBG for type 1 diabetes patients on multiple daily injections to reduce hypoglycemia risk. Triggered by clinician questions such as "Should I use CGM or SMBG for this T1D patient on MDI?" or "Is CGM preferred for glucose monitoring in this patient?"

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

This skill suggests using real-time continuous glucose monitoring (CGM) and algorithm-driven insulin pumps (ADIPs) rather than multiple daily injections (MDIs) with self-monitoring of blood glucose (SMBG) three or more times daily for adults and children with type 1 diabetes (T1D). Trigger phrases include "Should I use RT-CGM+ADIP or MDI+SMBG for this T1D patient?" or "Is intensive pump therapy indicated for this patient?"

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Identifies and exploits SMB protocol vulnerabilities using Metasploit Framework during authorized penetration tests to demonstrate risks from unpatched Windows systems, misconfigured shares, and weak authentication in enterprise networks.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Deploy Suricata to detect suspicious network traffic or block it inline. Configure protocol inspection, detection rules, and structured EVE JSON logs, then connect logs to analysis platforms and check packet drops and alert quality during operation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Deploying network intrusion monitoring
• Configuring inline blocking of malicious traffic
• Adding custom detection rules and reducing noisy alerts

Set up Havoc infrastructure for authorized attack simulations, including its command server, traffic listeners, Nginx relay servers, and Windows agents. The skill also covers communication profiles and operational precautions for running the infrastructure.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Preparing Havoc infrastructure for an authorized exercise
• Reviewing server and traffic relay separation
• Configuring communication profiles for an exercise

Assess forced authentication and NTLM relay, the forwarding of authentication to another service, in authorized Windows environments. Use Coercer and PetitPotam to document exposed methods and check detection coverage, signing requirements, and Extended Protection for Authentication safeguards.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing exposed forced authentication methods
• Validating NTLM relay risks in authorized environments
• Generating activity to tune security detections

Help small business owners get started with Claude by guiding two tool connections and trying a task tied to their main concern. Capture business context, suggest relevant skills, and establish a weekly check-in routine.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Start using Claude for business tasks
• Connect tools already used in daily operations
• Save business context and choose initial skills

Azure Storage File Share SDK for Python. Use for SMB file shares, directories, and file operations in the cloud. Triggers: "azure-storage-file-share", "ShareServiceClient", "ShareClient", "file share", "SMB".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Authentication coercion (PetitPotam MS-EFSR, PrinterBug MS-RPRN, DFSCoerce MS-DFSNM) chained into NTLM relay (impacket ntlmrelayx) toward LDAP, AD CS web enrollment (ESC8), or SMB. Use when SMB signing is not enforced or LDAP channel binding is missing, and you want to force a privileged machine account to authenticate to your relay and turn that into RBCD, a DCSync-capable ACL grant, or a certificate. Includes the exact Coercer/ntlmrelayx commands, requirements, detection, and remediation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Kerberos, WinRM, SMB, RDP, Windows credential material, replayable tickets, delegation edges, and host-to-host pivot chains. Use when the user asks to replay Kerberos material, trace a WinRM, SMB, or RDP pivot, understand host-to-host privilege movement, or prove which Windows service accepted a credential or ticket. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Execute commands and binaries on remote Windows systems utilizing PsExec and SMB/RPC mechanisms. This skill details the mechanics behind tools like Sysinternals PsExec, Impacket's psexec.py, and their role in lateral movement via hidden administrative shares.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.