Initial commit - 611 cybersecurity skills across all subdomains

skills/performing-active-directory-vulnerability-assessment/references/standards.md

@@ -0,0 +1,41 @@
+# Standards and References - AD Vulnerability Assessment
+
+## Primary Standards
+
+### MITRE ATT&CK - Active Directory Techniques
+- **URL**: https://attack.mitre.org/
+- **Key Techniques**:
+  - T1558.003 - Kerberoasting
+  - T1558.004 - AS-REP Roasting
+  - T1557.001 - LLMNR/NBT-NS Poisoning
+  - T1484.001 - Group Policy Modification
+  - T1134.005 - SID-History Injection
+  - T1003.006 - DCSync
+
+### CIS Benchmark for Active Directory
+- **URL**: https://www.cisecurity.org/benchmark/active_directory
+- **Relevance**: Provides prescriptive hardening guidance for AD configuration
+
+### Microsoft Security Compliance Toolkit
+- **URL**: https://www.microsoft.com/en-us/download/details.aspx?id=55319
+- **Relevance**: Baseline GPO settings for domain controllers and member servers
+
+### NIST SP 800-63B
+- **Title**: Digital Identity Guidelines - Authentication and Lifecycle Management
+- **URL**: https://pages.nist.gov/800-63-3/sp800-63b.html
+- **Relevance**: Password policy requirements applicable to AD accounts
+
+### NSA Active Directory Security Guidance
+- **Title**: Detecting and Preventing Active Directory Attacks
+- **Relevance**: NSA recommendations for securing AD against common attack techniques
+
+## Tools
+
+| Tool | License | URL |
+|------|---------|-----|
+| PingCastle | Open Source (Netwrix) | https://github.com/netwrix/pingcastle |
+| BloodHound CE | Apache 2.0 | https://github.com/SpecterOps/BloodHound |
+| SharpHound | Apache 2.0 | https://github.com/SpecterOps/BloodHound |
+| Purple Knight | Free Community | https://www.purple-knight.com/ |
+| ADRecon | MIT | https://github.com/adrecon/ADRecon |
+| Testimo | MIT | https://github.com/EvotecIT/Testimo |

skills/performing-active-directory-vulnerability-assessment/references/workflows.md

@@ -0,0 +1,45 @@
+# Workflows - AD Vulnerability Assessment
+
+## Workflow 1: Comprehensive AD Security Assessment
+
+### Steps
+1. Run PingCastle health check to get overall AD security score
+2. Review PingCastle report for stale objects, privilege issues, trust problems, and anomalies
+3. Run SharpHound data collection against the domain
+4. Upload SharpHound data to BloodHound CE
+5. Execute critical BloodHound queries (shortest path to DA, Kerberoastable admins, delegation issues)
+6. Run Purple Knight for additional security indicator checks
+7. Consolidate findings from all three tools into unified report
+8. Prioritize findings by risk severity and attack path impact
+9. Generate remediation plan with specific PowerShell/GPO fix commands
+
+## Workflow 2: Attack Path Remediation
+
+### Steps
+1. Identify top 5 shortest attack paths to Domain Admin from BloodHound
+2. For each path, determine the weakest link (misconfigured ACL, session reuse, etc.)
+3. Remediate weakest links to break attack paths
+4. Re-run BloodHound collection to verify paths are eliminated
+5. Document remediated paths and remaining risk
+
+## Workflow 3: Privileged Account Hardening
+
+### Steps
+1. Export all members of privileged groups from PingCastle report
+2. Validate each account has legitimate business need for privilege
+3. Remove unnecessary privileged group memberships
+4. Implement tiered administration model (Tier 0/1/2)
+5. Enable Protected Users group for sensitive accounts
+6. Configure AdminSDHolder with correct ACLs
+7. Verify changes with follow-up PingCastle scan
+
+## Workflow 4: Kerberos Security Hardening
+
+### Steps
+1. Identify all Kerberoastable accounts from BloodHound
+2. Convert user-assigned SPNs to Managed Service Accounts (MSA/gMSA) where possible
+3. For remaining SPNs, ensure 25+ character passwords with rotation
+4. Disable DES and RC4 encryption for Kerberos
+5. Enable AES-256 encryption for all accounts
+6. Enable Kerberos pre-authentication for all accounts
+7. Configure constrained delegation to replace unconstrained delegation