ad-persistence
Warn
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONCREDENTIALS_UNSAFEDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous commands for executing powerful offensive tools and system-level modifications.
- Modifies the Windows registry (
HKLM\SYSTEM\CurrentControlSet\Control\Lsa) to install custom Security Support Providers (SSPs) for credential harvesting. - Performs LSASS process manipulation via Mimikatz, including removing process protection and injecting master passwords (Skeleton Key).
- Utilizes
reg addandcopycommands to modify system directories and configurations. - [CREDENTIALS_UNSAFE]: Includes hardcoded passwords within command examples.
- Use of
BackupPass123!for certificate authority backups. - Use of
CertPass!andBackupPass123!for certificate forging operations. - References the default password
mimikatzfor the Skeleton Key technique. - [DATA_EXFILTRATION]: Provides procedures for extracting highly sensitive domain material.
- Instructions for backing up the Certificate Authority (CA) private key.
- Extraction of ADFS token-signing certificates and DKM keys from Active Directory objects.
- Harvesting cleartext credentials using persistent and in-memory SSP logging.
- [EXTERNAL_DOWNLOADS]: The skill relies on and provides instructions for a large collection of external offensive security tools.
- Tools include Mimikatz, Certipy, Rubeus, ForgeCert, ADFSpoof, ADFSDump, Impacket, Nishang, and bloodyAD.
- [DATA_EXFILTRATION]: Contains commands to query and extract sensitive attributes from Active Directory via LDAP, such as
thumbnailPhotofor ADFS key retrieval.
Audit Metadata