The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: Employs a PowerShell download cradle (IEX(New-Object Net.WebClient).DownloadString(...)) to fetch and execute remote scripts from an external URL. It also uses Add-Type to dynamically compile and execute C# code for token privilege inspection.
[EXTERNAL_DOWNLOADS]: References external tools and scripts such as WinPEAS, PowerUp, and Seatbelt intended to be transferred to and executed on the target system.
[COMMAND_EXECUTION]: Executes a wide variety of Windows system utilities including wmic, sc, net, schtasks, and reg to enumerate configurations and identify misconfigurations.
[CREDENTIALS_UNSAFE]: Systematically hunts for sensitive information, targeting files and registry keys such as the SAM hive, unattend.xml, web.config, and PowerShell command history.
[DATA_EXFILTRATION]: Instructs the agent to capture and return discovered credentials, vulnerabilities, and pivot paths to an external orchestrator.

windows-discovery