59 个 · 按相关度排序
Analyze Windows identity and host evidence in CTF sandboxes. Connect authentication tickets, credentials, mailbox rules, and host activity to explain which services accept access and how movement between hosts occurs.
中文简介正在准备中。当前显示英语简介。
Investigate attackers moving between internal systems by correlating login records with network traffic. Supports detection rules, suspicious SMB and RDP activity analysis, and reports showing attack timelines, affected hosts, and monitoring gaps.
中文简介正在准备中。当前显示英语简介。
Investigate lateral movement, where attackers expand access across Azure identities and tenants. Correlate audit logs and unusual sign-ins, build Microsoft Sentinel detection queries, and report affected identities with recommended containment actions.
中文简介正在准备中。当前显示英语简介。
Hunt for lateral movement, where attackers move between networked systems, using Splunk searches. Connect Windows logins with process and network activity to identify unusual host relationships, trace movement paths, and document affected accounts and systems.
中文简介正在准备中。当前显示英语简介。
Analyze Zeek network logs to find lateral movement, when an intruder spreads between internal computers. Examine administrative file sharing, authentication across multiple hosts, and remote service operations to identify suspicious connections and reconstruct incident timelines.
中文简介正在准备中。当前显示英语简介。
Check industrial process data servers for unauthorized clients and suspicious data patterns using a Python detector. Provides alerts for missing or constant values and investigation checks for attackers moving between IT and operational technology networks.
中文简介正在准备中。当前显示英语简介。
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Active Directory, Kerberos, LDAP, OAuth, enterprise messaging, Windows host forensics, credential material, and lateral-movement challenges. Use when the user asks to trace tickets or tokens, inspect mailbox rules, analyze Windows host evidence, understand an AD trust path, or explain a lateral-movement chain across sandbox-linked nodes. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
中文简介正在准备中。当前显示原文说明。
Execute commands and binaries on remote Windows systems utilizing PsExec and SMB/RPC mechanisms. This skill details the mechanics behind tools like Sysinternals PsExec, Impacket's psexec.py, and their role in lateral movement via hidden administrative shares.
中文简介正在准备中。当前显示原文说明。
Execute lateral movement within Microsoft Entra ID (formerly Azure AD) and Microsoft 365 environments. Use this skill to traverse cloud resources using compromised user tokens, managed identities, Primary Refresh Tokens (PRT), and application permissions (Service Principals) to achieve Global Administrator access.
中文简介正在准备中。当前显示原文说明。
Hunts for lateral movement via remote service creation, admin share writes, and remote WMI process creation by correlating Windows logon, service install, and process-creation events. Activates for requests to hunt lateral movement, detect PsExec/WMIexec activity, or find remote execution over SMB and WMI.
中文简介正在准备中。当前显示原文说明。
Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zeek, Velociraptor, and SIEM correlation rules to detect attackers moving between systems.
中文简介正在准备中。当前显示原文说明。
Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service abuse.
中文简介正在准备中。当前显示原文说明。
Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, NTLM account spray activity, remote service execution, and anomalous internal connections.
中文简介正在准备中。当前显示原文说明。
Detect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomaly correlation to identify privilege escalation, token theft, and cross-tenant pivoting.
中文简介正在准备中。当前显示原文说明。
tespit etmelateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomaly correlation to identify privilege escalation, token theft, and cross-tenant pivoting.
中文简介正在准备中。当前显示原文说明。
Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, Pass-the-Hash activity, remote service execution, and anomalous internal connections.
中文简介正在准备中。当前显示原文说明。
Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service abuse.
中文简介正在准备中。当前显示原文说明。
Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zeek, Velociraptor, and SIEM correlation rules to detect attackers moving between systems.
中文简介正在准备中。当前显示原文说明。
Detect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomaly correlation to identify privilege escalation, token theft, and cross-tenant pivoting.
中文简介正在准备中。当前显示原文说明。
Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service abuse.
中文简介正在准备中。当前显示原文说明。
Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, NTLM account spray activity, remote service execution, and anomalous internal connections.
中文简介正在准备中。当前显示原文说明。
Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zeek, Velociraptor, and SIEM correlation rules to detect attackers moving between systems.
中文简介正在准备中。当前显示原文说明。
Detect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomaly correlation to identify privilege escalation, token theft, and cross-tenant pivoting.
中文简介正在准备中。当前显示原文说明。
Use CloudFox to inspect AWS and Azure resources through read-only queries. Identify exposed endpoints, secrets, permissions, and role trust relationships, then organize findings into files for reviewing configuration weaknesses and potential paths to broader access.
中文简介正在准备中。当前显示英语简介。