Loading…
Compare your environment to what it should be. See the gap. Harden it.
Controls can be mapped to CIS, NIST 800-53/800-171, NIST CSF, and ISO 27002.
We have not tested the tool enough across different environments. Request it with a company email; we will send a free build for the platforms you ask for. Run it, evaluate it, and share logs and feedback.
Visible in the list; control bodies are not open yet. Comparison is available for the four open environments.
A guide to hardening the email and DNS layer. DMARC enforcement (p=reject) on top of SPF/DKIM, MTA-STS/TLS-RPT and BIMI, secure email gateway (Safe Links/Attachments, anti-impersonation), blocking automatic forwarding, DNSSEC, protective DNS (PDNS), and registrar/registry lock. Significantly reduces phishing, BEC, and domain spoofing.
Vulnerabilities under active exploitation in CISA KEV.
What to do when an incident occurs — step by step, aligned with NIST SP 800-61 phases. 78 playbooks · 1984 response steps.
A comprehensive defense-perspective analysis of data exfiltration and C2 channels: DNS tunneling (iodine/dnscat2), HTTPS C2, beaconing and jitter, domain fronting (largely blocked by major CDNs), malleable C2 (Cobalt Strike), staging/compression/encryption, ICMP and cloud storage exfil, and DoH. For detection: NetFlow/Zeek, JA3/JARM/JA4+, RITA beacon analysis, DNS entropy; for prevention: egress filtering, DNS RPZ, and TLS inspection.
A comprehensive map of NT hash, Kerberos ticket, and plaintext password theft via memory dumping of Windows authentication backbone LSASS (lsass.exe): Mimikatz/sekurlsa, comsvcs LOLBin, ProcDump, and nanodump attack methods; Sysmon EID 10 GrantedAccess masks + Sigma-based technical detection; Credential Guard, RunAsPPL, WDigest disable, and ASR rule hardening controls.
A comprehensive map of Windows UAC bypass (T1548.002) and access token manipulation (T1134) techniques: integrity levels, HKCU registry hijack families (fodhelper/eventvwr/sdclt/computerdefaults/SilentCleanup), token theft API chain, SeImpersonatePrivilege, and the Potato family (JuicyPotato/PrintSpoofer/RoguePotato/GodPotato). For each technique, the how-it-works → how-to-detect → how-to-prevent triad is provided.
Windows Management Instrumentation (WMI) event subscription writes the __EventFilter (WQL trigger), __EventConsumer (command/script payload), and __FilterToConsumerBinding triplet persistently into the root\\subscription CIM repository, providing a backdoor that runs with SYSTEM privileges and leaves no traditional autorun trace on disk. For detection, Sysmon EID 19/20/21 and WMI-Activity EID 5861 form the primary signature layer; process tree anomaly and subscription hunting form the behavioral layer.
When dangerous rights on DACLs attached to every Active Directory object (GenericAll, WriteDACL, WriteOwner, AllExtendedRights, ForceChangePassword, AddMember) are exploited, an attacker can trigger chains of password resets, group additions, targeted Kerberoasting, shadow credential injection, and DCSync permission grants with just a few LDAP operations. A single ACE added to the AdminSDHolder object propagates to all protected objects in a 60-minute cycle via the SDProp mechanism, creating a self-repairing backdoor. Detection relies on attribute-level behavioral monitoring on Events 5136/4662/4670; prevention relies on least privilege, tiered architecture, and periodic BloodHound ACL auditing.
