111 个 · 按相关度排序
Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, stale accounts, conditional access gaps, and guest user risks using AzureAD PowerShell, Microsoft Graph API, and ScoutSuite.
中文简介正在准备中。当前显示原文说明。
Detect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and WriteOwner abuse paths
中文简介正在准备中。当前显示原文说明。
BloodHound is a graph-based Active Directory reconnaissance tool that uses graph theory to reveal hidden and unintended relationships within AD environments. Red teams use BloodHound to identify attac
中文简介正在准备中。当前显示原文说明。
Exploit misconfigured Active Directory Certificate Services (AD CS) ESC1 vulnerability to request certificates as high-privileged users and escalate domain privileges during authorized red team assessments.
中文简介正在准备中。当前显示原文说明。
Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege paths, and exploitable trust relationships that could lead to domain compromise. The tester uses BloodHound for attack path analysis, Mimikatz for credential extraction, and Impacket for protocol-level attacks including Kerberoasting, AS-REP Roasting, and delegation abuse. Activates for requests involving Active Directory pentest, AD attack simulation, domain compromise testing, or Kerberos attack assessment.
中文简介正在准备中。当前显示原文说明。
Detect DCSync attacks where adversaries abuse Active Directory replication privileges to extract password hashes by monitoring for non-domain-controller accounts requesting directory replication via DsGetNCChanges.
中文简介正在准备中。当前显示原文说明。
Deploys deception-based honeytokens in Active Directory including fake privileged accounts with AdminCount=1, fake SPNs for Kerberoasting detection (honeyroasting), decoy GPOs with cpassword traps, and fake BloodHound paths. Monitors Windows Security Event IDs 4769, 4625, 4662, 5136 for honeytoken interaction. Use when implementing AD deception defenses for detecting lateral movement, credential theft, and reconnaissance.
中文简介正在准备中。当前显示原文说明。
Implement Microsoft's Enhanced Security Admin Environment (ESAE) tiered administration model for Active Directory. Covers Tier 0/1/2 separation, privileged access workstations (PAWs), administrative f
中文简介正在准备中。当前显示原文说明。
Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, stale accounts, conditional access gaps, and guest user risks using AzureAD PowerShell, Microsoft Graph API, and ScoutSuite.
中文简介正在准备中。当前显示原文说明。
Detect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and WriteOwner abuse paths
中文简介正在准备中。当前显示原文说明。
Support authorized security assessments of Microsoft Active Directory with guidance on environment discovery, credential risks, authentication weaknesses, and privilege escalation. The material organizes tools and workflows for penetration testing and controlled training environments.
中文简介正在准备中。当前显示英语简介。
Investigate NTLM relay, an attack that forwards authentication messages to another service, by comparing Windows login events with host inventories. Use the supplied queries and audits to identify suspicious sources, weaker authentication, and gaps in signing enforcement.
中文简介正在准备中。当前显示英语简介。
Investigate stolen Kerberos tickets, authentication credentials that can be reused without a password, by correlating Windows security events. Build Splunk or Elastic detection rules for cross-host reuse, weaker encryption, and unusual request volumes, and report risk-scored findings.
中文简介正在准备中。当前显示英语简介。
Investigate Active Directory authentication logs with Splunk and KQL queries to find signs of Golden Ticket attacks, which use forged Kerberos authentication tickets. Examine encryption mismatches, missing ticket requests, unusual lifetimes, and account inconsistencies.
中文简介正在准备中。当前显示英语简介。
Investigate forged Kerberos authentication tickets in Active Directory by checking Windows logs for unusual encryption, excessive ticket lifetimes, and missing authentication requests. Produce a JSON report of suspicious indicators with risk ratings.
中文简介正在准备中。当前显示英语简介。
Examine Windows and Active Directory logs for attempts to extract passwords and other credentials. Identify suspicious memory access and database exports, correlate events with user and host context, and produce findings with severity ratings and detection queries.
中文简介正在准备中。当前显示英语简介。
Assess forced authentication and NTLM relay, the forwarding of authentication to another service, in authorized Windows environments. Use Coercer and PetitPotam to document exposed methods and check detection coverage, signing requirements, and Extended Protection for Authentication safeguards.
中文简介正在准备中。当前显示英语简介。
Map Active Directory permissions, group memberships, and user sessions with BloodHound CE. Reveal paths from ordinary accounts to administrator privileges, prioritize findings, and document evidence for authorized assessments or checks after security hardening.
中文简介正在准备中。当前显示英语简介。
Support authorized Active Directory assessments of DCSync, which abuses directory replication rights to obtain credential data. Cover replication permission review, Golden Ticket persistence testing, detection validation, and documentation of evidence and remediation recommendations.
中文简介正在准备中。当前显示英语简介。
Analyze Windows event logs in Splunk to investigate suspicious logins, privilege changes, persistence, and movement between computers. Build detection searches and organize endpoint activity into timelines, with findings linked to MITRE ATT&CK attack techniques.
中文简介正在准备中。当前显示英语简介。
Assess Shadow Credentials account takeover during authorized Active Directory testing. Examine permissions that allow public key registration, validate authentication without a password reset, and document credential cleanup, detection opportunities, and access control changes needed for remediation.
中文简介正在准备中。当前显示英语简介。
Assess exposure of Windows secrets protected by DPAPI, the operating system’s data protection service, during authorized security tests. Guide examination and decryption of saved credentials and browser data using available user sessions, credentials, or backup keys.
中文简介正在准备中。当前显示英语简介。
Assess Active Directory security by mapping accounts, permissions, and paths to administrative access. The skill covers credential misuse, certificate service misconfigurations, movement between systems, and hybrid identity environments involving Entra ID.
中文简介正在准备中。当前显示英语简介。
Guide Windows domain penetration testing through Active Directory reconnaissance, credential attacks, privilege escalation, and certificate service checks. Use references for tools such as BloodHound and Impacket to examine attack paths and understand testing prerequisites.
中文简介正在准备中。当前显示英语简介。