identity-ad-nopac
Identity Ad Nopac.
- License 许可
- MIT
- 最近更新
- 2026-09-01
- Stars
- ★ 0
- Forks
- 0
01 前言 Front Matter
- name
- identity-ad-nopac
- domain
- cybersecurity
- description
- Identity Ad Nopac.
02 资源文件 1
- 参考文档index.json468 B
03 SKILL.md 正文
--| | Machine account sAMAccountName change | Event 4742 (computer account changed) with sAMAccountName modification | | New machine account creation | Event 4741 (computer object created) | | TGT request for account without trailing $ | Kerberos audit log analysis | | S4U2self requests from non-DC machine accounts | Event 4769 with unusual service ticket requests | | Rapid sequence: create account, rename, request TGT | SIEM correlation rule for noPac attack pattern |
Validation Criteria
- [ ] Domain scanned for noPac vulnerability
- [ ] MachineAccountQuota verified (default 10)
- [ ] Exploit executed successfully (shell or DCSync)
- [ ] Domain Admin privileges obtained from standard user
- [ ] DCSync performed to dump domain credentials
- [ ] KRBTGT hash obtained for persistence validation
- [ ] Attack chain documented with timestamps
- [ ] Patch status verified (KB5008380, KB5008602)
04 同仓库更多 Skills
services-wmi-persistence-detect
Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.
services-wmi-exec-exploit
Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.
registry-artifact-extract
Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.
processes-token-impersonate-detect
Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.
processes-thread-injection-detect
Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.
processes-hollow-technique-detect
Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.