RAG Security First

search_knowledge(query="rundll32 comsvcs MiniDump LSASS credential dump",
                 max_results=5, min_score=0.15)
→ 4 hits: mitre-T1003.001-lsass.md (0.94), redteam-cred-dumping.md (0.82),
          blueteam-lsass-detection.md (0.79), edr-tuning-lsass.md (0.71)

Reply: "Yes, high-confidence malicious [mitre-T1003.001-lsass.md].

**Technique:** MITRE ATT&CK T1003.001 (OS Credential Dumping: LSASS Memory)
via the built-in `comsvcs.dll` MiniDump helper. Legitimate use of this
command is extremely rare.

**Detection signals** [blueteam-lsass-detection.md]:
- Process: `rundll32.exe` with cmdline containing `comsvcs.dll` + `MiniDump`
- Parent process: often `cmd.exe` or `powershell.exe` after initial access
- File write: `.dmp` file with LSASS-typical size (~50-500 MB)

**Immediate response** [runbooks/incident-lsass-dump.md]:
1. Isolate the host (network quarantine, do not power off — preserve memory)
2. Capture the dump before attacker retrieves it
3. Rotate credentials of every user logged on to that host (last 24h)
4. Kerberos: krbtgt reset if attacker had time to Golden Ticket

**Related ATT&CK:** T1078 (Valid Accounts, likely next step),
T1550 (Alternate Auth Material)."

search_knowledge(query="CVE-2024-3400", max_results=5) → 0 hits (specific CVE not indexed)
search_knowledge(query="PAN-OS GlobalProtect vulnerability", max_results=5) → 2 hits
  → asset-inventory-perimeter.md (0.68), vuln-response-playbook.md (0.55)

Reply: "The corpus does not have CVE-2024-3400 specifically indexed. Checking external
sources... [chains to mcp__cti__vuln_cve(cve_id='CVE-2024-3400')]

From external threat intel: CVE-2024-3400 is a critical PAN-OS GlobalProtect command
injection (CVSS 10.0), actively exploited since March 2024.

**Relevance to your infra** [asset-inventory-perimeter.md]:
- Your perimeter inventory lists 2 PAN-OS firewalls in scope.
- Response playbook: [vuln-response-playbook.md] — priority PATCH within 24h
  for internet-facing PAN-OS with GlobalProtect enabled.

**Next steps:**
1. Confirm PAN-OS version on those 2 firewalls
2. Check if GlobalProtect gateway feature is enabled (only vulnerable if yes)
3. If yes → apply hotfix per PAN advisory; if no → still upgrade but non-emergency
4. Hunt for IOCs from the campaign — chain to mcp__cti__ti_check_ioc"

search_knowledge(query="Kerberoasting SPN request authorized pentest",
                 category="redteam", max_results=5)
→ 4 hits: kerberoasting-technique.md (0.91), rubeus-usage.md (0.83),
          post-exploit-cred-cracking.md (0.75), opsec-considerations.md (0.68)

Reply: "**MITRE ATT&CK T1558.003** (Steal or Forge Kerberos Tickets: Kerberoasting)
[kerberoasting-technique.md].

**Enumeration:**
```powershell
Get-ADUser -Filter {ServicePrincipalName -ne \"$null\"} -Properties ServicePrincipalName
# or Impacket:
GetUserSPNs.py DOMAIN/user:pass -dc-ip <DC>

Rubeus.exe kerberoast /outfile:hashes.txt /nowrap

hashcat -m 13100 hashes.txt rockyou.txt --force

---

## Edge cases

- **Corpus is not security-loaded** — `list_categories()` returns no security-flavored categories. Skill still works but degrades: no runbook citations, more escalation to external threat-intel MCPs.
- **Sensitive engagement content** — never quote client-specific IOCs from one engagement in another. Sanitize before responding.
- **Unauthorized attacker technique request** — if the user is asking how to attack a system without authorization, this skill does NOT help. Refuse per general policy — RAG-first is about *how to search*, not *what to search for*.
- **Live IOC that should not be cached** — if the response includes a live C2 IP or malware hash, do NOT `add_from_url` it into the RAG. Cite once and move on.

---

## Related skills

- **[`rag-check-first`](https://github.com/lyonzin/knowledge-rag/blob/master/skills/foundation/rag-check-first/SKILL.md)** — the base pattern (this is `check-first` with security priorities).
- **[`rag-cite-sources`](https://github.com/lyonzin/knowledge-rag/blob/master/skills/foundation/rag-cite-sources/SKILL.md)** — extra important in security (auditable trail matters).
- **[`rag-troubleshoot`](https://github.com/lyonzin/knowledge-rag/blob/master/skills/workflow/rag-troubleshoot/SKILL.md)** — incident triage often overlaps with debugging.
- **[`rag-index-decisions`](https://github.com/lyonzin/knowledge-rag/blob/master/skills/maintenance/rag-index-decisions/SKILL.md)** — after handling an incident, index the postmortem.