Technique Library

Expert

An Active Directory tiered administration architecture that structurally breaks credential theft and lateral movement. Clean source principle, Tier 0/1/2 boundaries and logon restrictions, Privileged Access Workstations (PAW), Protected Users group, Authentication Policy Silos, Credential Guard (VBS), and LSA Protection — all in one place. Significantly narrows the attack paths that turn the compromise of a single identity into the compromise of the entire environment.

June 24, 20266 min read

Exploit

Prevention

Detection

T1558Credential AccessAdvanced

Kerberos Ticket Attacks: From Kerberoasting to Ticket Forgery

A comprehensive map of ticket-based attacks against the Active Directory Kerberos protocol: how they work → how to detect them → how to prevent them for Kerberoasting (T1558.003), AS-REP Roasting (T1558.004), Golden/Silver Ticket (T1558.001/002), Pass-the-Ticket (T1550.003), and delegation abuse; including RC4 etype 0x17 / CVE-2026-20833 transition context and the AES Kerberoasting blind spot.

June 13, 202615 min read

Exploit

Prevention

Detection

T1528Credential AccessAdvanced

Microsoft Graph API and Permission Abuse: Illicit Consent, Application Roles, and OAuth Attacks

A comprehensive map of the attack surface on the OAuth permission model of Microsoft Graph API: illicit consent grant (T1528), service principal credential addition (T1098.001), application role escalation chains (T1098.003), and high-risk permission abuse. For each technique, Entra ID audit signals, KQL/Sigma, and hardening controls are provided.

June 13, 202615 min read

Exploit

Prevention

Detection

T1055Defense EvasionAdvanced

Process Injection: From Classic DLL to Process Hollowing and .NET Reflection

A comprehensive map of Windows process injection techniques: for every technique from classic DLL injection to process hollowing, Doppelgänging, APC/Early Bird, and .NET reflective assembly loading — the API chain, Sysmon/ETW detection, and defensive triad. A technical reference for red/purple team and SOC/DFIR teams.

June 13, 202618 min read

Exploit

Prevention

Detection

T1053.005PersistenceAdvanced

Persistence and Lateral Movement via Scheduled Tasks: Technical Analysis

Windows Task Scheduler (schtasks.exe / Schedule.Service COM) is widely used by attackers for both persistence and remote execution (lateral movement). This article covers schtasks syntax, XML task structure, TaskCache registry, EID 4698/4699/4700/4701/4702 + TaskScheduler/Operational 106/140/141/200/201 telemetry, Sigma rules, and hardening controls.

June 13, 202610 min read

Exploit

Prevention

Detection

T1059.001ExecutionAdvanced

PowerShell Attacks and Visibility: Script Block Logging, AMSI, and Bypass

Covers PowerShell's Windows logging architecture (EID 4104 Script Block, EID 4103 Module, Transcription, EID 400 downgrade detection) and the AMSI infrastructure from an attack perspective. AMSI bypass families (AmsiScanBuffer patching, amsiContext manipulation, VEH patchless, obfuscation), PSv2 downgrade, and download cradles are addressed in the Exploit & POC section; behavioral Sigma rules and a correlation schema in Detection; mandatory GPO configuration, CLM/WDAC, PSv2 removal, and WEF centralized collection in Prevention.

June 13, 202617 min read

Exploit

Prevention

Detection

T1190Initial AccessAdvanced

Web Application Attacks: XSS, SSRF, IDOR, Deserialization and Defense

A comprehensive technical analysis of web application attack classes covered by OWASP Top 10 2021; covers XSS, SSRF, IDOR/Broken Access Control, insecure deserialization, CSRF, XXE, command injection, path traversal, and web shell techniques through the exploit/POC, detection, and prevention triad.

June 13, 202620 min read

Exploit

Prevention

Detection

T1190Initial AccessAdvanced

SQL Injection: Classic, Blind, Error-Based, Out-of-Band, and Modern Defenses

SQL injection (CWE-89) originates from embedding user input directly into an SQL query; an attacker can modify the query structure to exfiltrate data, bypass authentication, and under certain conditions execute operating system commands. This article covers UNION-based, error-based, boolean/time-based blind, and OOB classes with DBMS-specific syntax and sqlmap usage; provides WAF log patterns and a Sigma rule for detection; and gives parameterized queries, least privilege, and allowlisting for prevention.

June 13, 202615 min read

Exploit

Prevention

Detection

T1041ExfiltrationAdvanced

Data Exfiltration and C2 Channels: Exfiltration Techniques, OPSEC, and Detection

A comprehensive defense-perspective analysis of data exfiltration and C2 channels: DNS tunneling (iodine/dnscat2), HTTPS C2, beaconing and jitter, domain fronting (largely blocked by major CDNs), malleable C2 (Cobalt Strike), staging/compression/encryption, ICMP and cloud storage exfil, and DoH. Detection covers NetFlow/Zeek, JA3/JARM/JA4+, RITA beacon analysis, and DNS entropy; mitigations include egress filtering, DNS RPZ, and TLS inspection.

June 13, 202615 min read

Exploit

Prevention

Detection

T1087.002DiscoveryIntermediate

Active Directory Reconnaissance with BloodHound: Collection Behavior, Attack Path Analysis, and Defense

A comprehensive map of Active Directory reconnaissance with BloodHound/SharpHound: collection methods (Default, All, DCOnly, Session, LoggedOn, ACL, Trusts, Container), node/edge types and Cypher attack path queries, OpSec/noise assessment, LDAP 1644 + 5145-based detection, session enumeration hardening, and ACL hygiene. A technical reference for SOC/DFIR and red/purple teams.

June 13, 202613 min read

Exploit

Prevention

Detection

T1557.001Credential AccessAdvanced

NTLM Authentication Attacks: From Pass-the-Hash, NTLM Relay, and Forced Authentication to LLMNR/NBT-NS Poisoning

A comprehensive map of attacks targeting NTLM authentication in on-premises Active Directory environments: LLMNR/NBT-NS poisoning and NetNTLM hash harvesting (Responder), forced authentication (PetitPotam MS-EFSRPC/CVE-2021-36942, PrinterBug MS-RPRN, DFSCoerce MS-DFSNM, ShadowCoerce), NTLM relay (SMB→LDAP/LDAPS/ADCS ntlmrelayx chain), Pass-the-Hash, NTLMv1 downgrade, and countermeasures (SMB signing, EPA, LDAP channel binding, Protected Users, mitm6). The detection-prevention triad for SOC, DFIR, and red/purple teams.

June 13, 202615 min read

Exploit

Prevention

Detection

T1558Credential AccessExpert

Advanced Kerberos Delegation Exploitation: Unconstrained, Constrained, RBCD, and Forced Authentication

Three layers of Kerberos delegation exploitation: unconstrained (TrustedForDelegation + coercion for DC TGT harvesting), constrained (S4U2Self/S4U2Proxy + altservice trick), and resource-based constrained delegation (RBCD + MachineAccountQuota abuse). Printer Bug, PetitPotam, DFSCoerce coercion chains; Bronze Bit (CVE-2020-17049); Protected Users and Sensitive exemptions. Conceptual attack flows with Rubeus and impacket getST.py; detection rules based on 4624/4741/5136; hardening with MAQ=0, tiering, and ACL auditing.

June 13, 202617 min read

Exploit

Prevention

Detection

T1528Credential AccessAdvanced

Azure / Entra ID Identity Attacks: From Token Theft to Golden SAML — Cloud Identity Security

A comprehensive map of attacks targeting the Microsoft Entra ID (formerly Azure Active Directory) identity model: technical reference for purple/red teams and SOC teams, from token theft, device code phishing, Golden SAML, and managed identity abuse through to detection and hardening.

June 13, 202614 min read

Exploit

Prevention

Detection

T1649Credential AccessExpert

Active Directory Certificate Services (AD CS) Attacks: ESC1–ESC16 Domain Privilege Escalation

Active Directory Certificate Services (AD CS), when misconfigured, can allow a low-privileged user to obtain a Domain Admin certificate and fully compromise the domain via PKINIT. This article provides an in-depth examination of all escalation techniques from ESC1 through ESC16, the PKINIT chain, KB5014754 strong certificate mapping, and comprehensive defense controls. It is a technical reference for authorized red/purple team exercises and SOC/DFIR teams.

June 13, 202621 min read

Exploit

Prevention

Detection

T1562.001Defense EvasionExpert

EDR Evasion Techniques and Detection: Syscall Abuse, Unhooking, and Telemetry Integrity

Explains how modern EDRs use userland API hooks, kernel callbacks, and ETW telemetry; how attackers target these layers via direct/indirect syscall, NTDLL unhooking, ETW/AMSI patching, and call stack spoofing; and how defenders detect these with ETW-TI, kernel call stack analysis, and telemetry integrity monitoring. ATT&CK: T1562.001, T1106, T1027.007, T1620, T1574.013.

June 13, 202614 min read

Exploit

Prevention

Detection

T1134.005Defense EvasionExpert

Active Directory Trust and Forest Attacks: SID History, Trust Key, and Cross-Forest Escalation

A comprehensive map of AD trust architecture attacks: parent-child intra-forest ExtraSids escalation, trust key theft and forged inter-realm TGT generation, SID history injection, cross-forest Kerberoasting, TGT delegation (KB4490425), and foreign security principals. Event-based and behavioral detection for SOC/DFIR, SID filtering validation, and tier-0 hardening.

June 13, 202616 min read

Exploit

Prevention

Detection

T1543.003PersistenceAdvanced

Windows Service and SCM Abuse: Persistence, Privilege Escalation, and Lateral Movement

A comprehensive map of the Windows Service Control Manager (SCM) attack surface: new service creation (T1543.003), ServiceDll hijack, unquoted path / weak binary and registry ACL exploitation (T1574.009-011), PsExec-style transient service for lateral movement (T1569.002). EID 7045/4697, Sysmon EID 13 detection, and Sigma correlations for SOC and red/purple teams.

June 13, 202612 min read

Exploit

Prevention

Detection