The Agent Skills Directory

[PERSISTENCE]: The New-DevDriveVhdx.ps1 script contains functionality to establish persistence via a Windows Scheduled Task. Specifically, when the -RegisterAutoMount parameter is used, the script invokes Register-ScheduledTask to create a task that executes a PowerShell command at every user logon to automatically mount the Dev Drive virtual disk.
[COMMAND_EXECUTION]: The documentation in SKILL.md and the scripts themselves utilize the -ExecutionPolicy Bypass flag. This technique is used to execute PowerShell scripts while circumventing local security policies that might otherwise restrict unsigned script execution.
[PRIVILEGE_ESCALATION]: The skill requires administrative access to perform its primary functions. It uses elevated commands such as Set-MpPreference -PerformanceModeStatus Enabled and fsutil devdrv to modify the system's security posture by enabling Microsoft Defender's 'Performance Mode' and altering machine-wide filesystem filter policies.

windows-dev-drive