“lsass”的搜索结果

Investigate Windows credential theft by correlating endpoint monitoring data, Sysmon events, and security logs. The skill provides detection queries and a reporting format to identify suspicious access and assess which credentials may be compromised.

中文简介正在准备中。当前显示英语简介。

• Investigating alerts about suspicious LSASS access
• Hunting for credential theft across Windows systems
• Assessing the scope of potentially compromised credentials

Examine Windows and Active Directory logs for attempts to extract passwords and other credentials. Identify suspicious memory access and database exports, correlate events with user and host context, and produce findings with severity ratings and detection queries.

中文简介正在准备中。当前显示英语简介。

• Investigating alerts about suspicious LSASS access
• Finding signs of SAM or NTDS.dit extraction
• Creating detection queries for Splunk or Elastic

Examine Windows credential material in a CTF sandbox, including LSASS memory and Kerberos tickets. Distinguish stored secrets from credentials that actually work, and document the evidence linking their source to successful authentication or resulting privileges.

中文简介正在准备中。当前显示英语简介。

• Examining LSASS secrets and Windows logon sessions
• Checking whether recovered Kerberos tickets are usable
• Tracing DPAPI and SSP credential material

Investigate signs of Mimikatz credential theft using command lines, access to Windows authentication memory, file indicators, and known modules in memory. Correlate endpoint and security logs to assess suspicious alerts, document evidence, and recommend response actions.

中文简介正在准备中。当前显示英语简介。

• Investigating alerts about Windows authentication memory access
• Hunting for signs of credential theft
• Assessing compromise scope during incident response

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for LSASS-resident secrets, Windows logon sessions, Kerberos ticket caches, DPAPI-backed material, SSP artifacts, and replayable credential extraction. Use when the user asks to inspect LSASS memory, recover tickets or logon sessions, trace DPAPI or SSP material, distinguish which credential artifacts are replayable, or connect host-resident credential material to an accepted pivot or privilege edge. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

中文简介正在准备中。当前显示原文说明。

Hunts for credential dumping by detecting LSASS process access with suspicious access masks, known dumping tool signatures, and comsvcs.exe MiniDump abuse in Sysmon Event ID 10 and process-creation telemetry. Activates for requests to hunt credential dumping, detect LSASS access, or find Mimikatz/comsvcs MiniDump activity.

中文简介正在准备中。当前显示原文说明。

Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft using Sysmon Event ID 10, Windows Security logs, and SIEM correlation rules

中文简介正在准备中。当前显示原文说明。

Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft using Sysmon Event ID 10, Windows Security logs, and SIEM correlation rules

中文简介正在准备中。当前显示原文说明。

Detect OS credential dumping techniques targeting LSASS memory, SAM database, NTDS.dit, and cached credentials using EDR telemetry, Sysmon process access monitoring, and Windows security event correlation.

中文简介正在准备中。当前显示原文说明。

Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft using Sysmon Event ID 10, Windows Security logs, and SIEM correlation rules

中文简介正在准备中。当前显示原文说明。

Investigate Windows secrets protected by DPAPI, a system for encrypting sensitive data, in a CTF sandbox. Trace the required keys and account context through decryption, then verify which service accepts the recovered secret.

中文简介正在准备中。当前显示英语简介。

• Inspect DPAPI-protected data and masterkeys
• Trace credentials stored by browsers or Windows Vault
• Identify the account or machine context needed for decryption

Trace movement between Windows hosts in a CTF sandbox using credentials and Kerberos tickets, which carry authentication information. Connect recovered artifacts to the service that accepted them and document the resulting access or privileges.

中文简介正在准备中。当前显示英语简介。

• Trace movement between Windows hosts
• Identify services that accept recovered credentials
• Connect Kerberos tickets to resulting access

Assess whether stolen Kerberos tickets, credentials used for network authentication, can enable access to other systems during authorized testing. Guide ticket extraction and reuse, review detection indicators, and document evidence for security reports.

中文简介正在准备中。当前显示英语简介。

• Authorized testing of access through reused tickets
• Checking detection of Kerberos ticket theft
• Collecting evidence for lateral movement reports

Helps plan NetExec commands for penetration testing in Active Directory, the system used to manage Windows domain accounts. Covers authentication checks, shared resources, permissions, and information collection with examples organized by network protocol.

中文简介正在准备中。当前显示英语简介。

• Checking NetExec authentication options
• Enumerating domain users and shared resources
• Collecting data for BloodHound

Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting

中文简介正在准备中。当前显示原文说明。

Use when hunting threats or engineering detections — ATT&CK Detection-Strategies, Sigma + correlation with Detection-as-Code CI, Windows endpoint hunting (Sysmon/ETW/LSASS/LOLBins), network C2 hunting (JA4+, beaconing, DNS tunneling), cloud-identity hunting, Atomic Red Team purple-team validation

中文简介正在准备中。当前显示原文说明。

The telemetry each Active Directory technique generates and what alerts a defender: Kerberoasting produces Event 4769 with RC4 encryption (0x17) and an MDI alert, DCSync produces Event 4662 with the DS-Replication-Get-Changes GUID, AS-REP roasting produces Event 4768 with no pre-auth, LSASS dumping is blocked by EDR, plus a lateral-movement telemetry table by protocol (SMB/WMI/WinRM/RDP/DCOM). Use this whenever you run or plan an offensive AD technique and need to know what noise it makes, when writing the engagement's detection notes, or when a defender wants to know what to monitor. Teaches red teamers what is loud and blue teamers what to watch. Standard-tooling knowledge, no vendor engine.

中文简介正在准备中。当前显示原文说明。

OS post-exploitation after a stable host foothold: quiet host recon, host-native persistence (Windows Run/tasks/services/COM/WMI and Linux SSH/cron/systemd/SUID), long-term C2 (Sliver primary, Mythic/Havoc optional), targeted collection and exfil, and engagement cleanup. Does not own AD/cloud/K8s native persistence, Ligolo pivoting, LSASS dumping, or EDR bypass. Operator selects objectives; success is a live callback, verified persistence, delivered loot, or restored host — not generating an unused implant.

中文简介正在准备中。当前显示原文说明。

Detect Mimikatz execution through command-line patterns, LSASS access signatures, binary indicators, and in-memory detection of known modules.

中文简介正在准备中。当前显示原文说明。

Detect Mimikatz execution through command-line patterns, LSASS access signatures, binary indicators, and in-memory detection of known modules.

中文简介正在准备中。当前显示原文说明。

Detect Mimikatz execution through command-line patterns, LSASS access signatures, binary indicators, and in-memory detection of known modules.

中文简介正在准备中。当前显示原文说明。