windows-lateral-movement
Warn
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFECOMMAND_EXECUTIONPERSISTENCEPRIVILEGE_ESCALATIONDATA_EXFILTRATION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill provides detailed instructions for dumping credentials from the LSASS process and registry hives (SAM, SYSTEM, SECURITY), utilizing tools like Mimikatz, Procdump, and the comsvcs.dll MiniDump function.
- [COMMAND_EXECUTION]: Outlines numerous methods for executing arbitrary commands on remote hosts through services like PsExec, WMI, WinRM, and DCOM.
- [PERSISTENCE]: Documents techniques for maintaining long-term access using WMI event subscriptions to trigger execution based on system modification events.
- [PRIVILEGE_ESCALATION]: Covers methods for bypassing Protected Process Light (PPL) and utilizing administrative privileges to move laterally across a domain.
- [DATA_EXFILTRATION]: Describes the extraction of domain-wide identity data and sensitive system configuration files from Domain Controllers and workstations.
Audit Metadata