Claude Skills by CyberStrikeus

An adversary with root access may gather credentials by reading `securityd`’s memory.

Adversaries may acquire credentials from web browsers by reading files specific to the target browser.

Adversaries may acquire credentials from the Windows Credential Manager.

Adversaries may acquire user credentials from third-party password managers.

Adversaries may search for common password storage locations to obtain user credentials.

Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentication process to acquire user credentials as they are validated.

Adversaries may use Patch System Image to hard code a password in the operating system, thus bypassing of native authentication mechanisms for local accounts on network devices.

An adversary may abuse Active Directory authentication encryption properties to gain access to credentials on Windows systems.

Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.

Adversaries may patch, modify, or otherwise backdoor cloud authentication processes that are tied to on-premises user identities in order to bypass typical authentication mechanisms, access credent...

Adversaries may register malicious network provider dynamic link libraries (DLLs) to capture cleartext user credentials during the authentication process.

Adversaries may disable or modify conditional access policies to enable persistent access to compromised accounts.

Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts.

Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the communication of two or more networked devices.

Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network.

Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as Network Sniffing, Transmitted Da...

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Trans...

Adversaries who have the KRBTGT account password hash may forge Kerberos ticket-granting tickets (TGT), also known as a golden ticket.

Adversaries who have the password hash of a target service account (e.g.

Adversaries may abuse a valid Kerberos ticket-granting ticket (TGT) or sniff network traffic to obtain a ticket-granting service (TGS) ticket that may be vulnerable to Brute Force.

Adversaries may reveal credentials of accounts that have disabled Kerberos preauthentication by Password Cracking Kerberos messages.

Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache).

Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ticket.

Adversaries may forge web cookies that can be used to gain access to web applications or Internet services.

An adversary may forge SAML tokens with any permissions claims and lifetimes if they possess a valid SAML token-signing certificate.

Adversaries may forge credential materials that can be used to gain access to web applications or Internet services.

Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and netw...

Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, and Terraform Vault.

Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts.

Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts.

By responding to LLMNR/NBT-NS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system.

Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users.

Adversaries may steal or forge certificates used for authentication to access remote systems or resources.

Adversaries may try to gather information about registered local system services.

Adversaries may attempt to get a listing of open application windows.

Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.

Adversaries may check for Internet connectivity on compromised systems.

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.

Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system.

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.

Adversaries may attempt to get information about running processes on a system.

Adversaries may attempt to find local system groups and permission settings.

Adversaries may attempt to find domain-level groups and permission settings.

Adversaries may attempt to find cloud groups and permission settings.

Adversaries may attempt to discover group and permission settings.

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

Adversaries may attempt to get a listing of local system accounts.

Adversaries may attempt to get a listing of domain accounts.