100 个 · 按相关度排序
Investigate NTLM relay, an attack that forwards authentication messages to another service, by comparing Windows login events with host inventories. Use the supplied queries and audits to identify suspicious sources, weaker authentication, and gaps in signing enforcement.
中文简介正在准备中。当前显示英语简介。
Analyze Zeek network logs to find lateral movement, when an intruder spreads between internal computers. Examine administrative file sharing, authentication across multiple hosts, and remote service operations to identify suspicious connections and reconstruct incident timelines.
中文简介正在准备中。当前显示英语简介。
Trace movement between Windows hosts in a CTF sandbox using credentials and Kerberos tickets, which carry authentication information. Connect recovered artifacts to the service that accepted them and document the resulting access or privileges.
中文简介正在准备中。当前显示英语简介。
Helps plan NetExec commands for penetration testing in Active Directory, the system used to manage Windows domain accounts. Covers authentication checks, shared resources, permissions, and information collection with examples organized by network protocol.
中文简介正在准备中。当前显示英语简介。
Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, NTLM account spray activity, remote service execution, and anomalous internal connections.
中文简介正在准备中。当前显示原文说明。
Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, Pass-the-Hash activity, remote service execution, and anomalous internal connections.
中文简介正在准备中。当前显示原文说明。
Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, NTLM account spray activity, remote service execution, and anomalous internal connections.
中文简介正在准备中。当前显示原文说明。
Hunt for lateral movement, where attackers move between networked systems, using Splunk searches. Connect Windows logins with process and network activity to identify unusual host relationships, trace movement paths, and document affected accounts and systems.
中文简介正在准备中。当前显示英语简介。
Investigate attackers moving between internal systems by correlating login records with network traffic. Supports detection rules, suspicious SMB and RDP activity analysis, and reports showing attack timelines, affected hosts, and monitoring gaps.
中文简介正在准备中。当前显示英语简介。
Azure File Share JavaScript/TypeScript SDK (@azure/storage-file-share) for SMB file share operations. Use for creating shares, managing directories, uploading/downloading files, and handling file metadata. Supports Azure Files SMB protocol scenarios. Triggers: "file share", "@azure/storage-file-share", "ShareServiceClient", "ShareClient", "SMB", "Azure Files".
中文简介正在准备中。当前显示原文说明。
Execute advanced Man-in-the-Middle (MITM) NTLM Relay attacks specifically targeting environments where SMB Signing is purportedly enabled but improperly configured (e.g., exclusively required on Domain Controllers but NOT enforced universally on standard Workstations or File Servers). Utilize powerful tools like Responder and Impacket's NTLMRelayX to coercively capture NTLMv2 authentications (via LLMNR, WPAD, or Coercion methods like PetitPotam) and seamlessly relay them across the network identically yielding immediate Local Administrator command execution.
中文简介正在准备中。当前显示原文说明。
Active Directory and network lateral movement assessment. Pass-the-hash, pass-the-ticket, Kerberoasting, AS-REP roasting, NTLM relay, SMB relay, WMI/WinRM/PSRemoting abuse, constrained/unconstrained delegation, RBCD, cross-trust exploitation, and pivoting. Uses impacket, netexec, enum4linux-ng, smbmap, smbclient, bloodhound-python, Responder, ntlmrelayx, mitm6, and ldap-utils. Chains from /post-exploit or /credential-audit.
中文简介正在准备中。当前显示原文说明。
Hunts for lateral movement via remote service creation, admin share writes, and remote WMI process creation by correlating Windows logon, service install, and process-creation events. Activates for requests to hunt lateral movement, detect PsExec/WMIexec activity, or find remote execution over SMB and WMI.
中文简介正在准备中。当前显示原文说明。
Recommends CGM over SMBG for type 1 diabetes patients on multiple daily injections to reduce hypoglycemia risk. Triggered by clinician questions such as "Should I use CGM or SMBG for this T1D patient on MDI?" or "Is CGM preferred for glucose monitoring in this patient?"
中文简介正在准备中。当前显示原文说明。
This skill suggests using real-time continuous glucose monitoring (CGM) and algorithm-driven insulin pumps (ADIPs) rather than multiple daily injections (MDIs) with self-monitoring of blood glucose (SMBG) three or more times daily for adults and children with type 1 diabetes (T1D). Trigger phrases include "Should I use RT-CGM+ADIP or MDI+SMBG for this T1D patient?" or "Is intensive pump therapy indicated for this patient?"
中文简介正在准备中。当前显示原文说明。
Identifies and exploits SMB protocol vulnerabilities using Metasploit Framework during authorized penetration tests to demonstrate risks from unpatched Windows systems, misconfigured shares, and weak authentication in enterprise networks.
中文简介正在准备中。当前显示原文说明。
Deploy Suricata to detect suspicious network traffic or block it inline. Configure protocol inspection, detection rules, and structured EVE JSON logs, then connect logs to analysis platforms and check packet drops and alert quality during operation.
中文简介正在准备中。当前显示英语简介。
Assess forced authentication and NTLM relay, the forwarding of authentication to another service, in authorized Windows environments. Use Coercer and PetitPotam to document exposed methods and check detection coverage, signing requirements, and Extended Protection for Authentication safeguards.
中文简介正在准备中。当前显示英语简介。
Set up Havoc infrastructure for authorized attack simulations, including its command server, traffic listeners, Nginx relay servers, and Windows agents. The skill also covers communication profiles and operational precautions for running the infrastructure.
中文简介正在准备中。当前显示英语简介。
Help small business owners get started with Claude by guiding two tool connections and trying a task tied to their main concern. Capture business context, suggest relevant skills, and establish a weekly check-in routine.
中文简介正在准备中。当前显示英语简介。
Azure Storage File Share SDK for Python. Use for SMB file shares, directories, and file operations in the cloud. Triggers: "azure-storage-file-share", "ShareServiceClient", "ShareClient", "file share", "SMB".
中文简介正在准备中。当前显示原文说明。
Authentication coercion (PetitPotam MS-EFSR, PrinterBug MS-RPRN, DFSCoerce MS-DFSNM) chained into NTLM relay (impacket ntlmrelayx) toward LDAP, AD CS web enrollment (ESC8), or SMB. Use when SMB signing is not enforced or LDAP channel binding is missing, and you want to force a privileged machine account to authenticate to your relay and turn that into RBCD, a DCSync-capable ACL grant, or a certificate. Includes the exact Coercer/ntlmrelayx commands, requirements, detection, and remediation.
中文简介正在准备中。当前显示原文说明。
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Kerberos, WinRM, SMB, RDP, Windows credential material, replayable tickets, delegation edges, and host-to-host pivot chains. Use when the user asks to replay Kerberos material, trace a WinRM, SMB, or RDP pivot, understand host-to-host privilege movement, or prove which Windows service accepted a credential or ticket. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
中文简介正在准备中。当前显示原文说明。
Execute commands and binaries on remote Windows systems utilizing PsExec and SMB/RPC mechanisms. This skill details the mechanics behind tools like Sysinternals PsExec, Impacket's psexec.py, and their role in lateral movement via hidden administrative shares.
中文简介正在准备中。当前显示原文说明。