adcs-template-abuse

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to use and produce credentials (passwords, NT hashes, PFX passwords, tokens) in command examples and requires the return summary to list "new credentials or tokens found", which forces the LLM to handle and output secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an explicit offensive playbook for abusing AD CS templates to impersonate domain principals, extract credentials (NT hashes), perform unauthorized authentication (PKINIT/LDAPS), and modify AD for privilege escalation/persistence—clear malicious intent and actionable backdoor/credential-theft techniques.