network-pentest

The supplied content is an offensive Active Directory GPO-abuse guide. It contains no independently executing malware, but the commands and templates enable arbitrary code execution, persistence, domain account creation, privilege escalation, and broad lateral impact when an attacker has suitable GPO permissions. It should be treated as high-risk operational security content and used only in explicitly authorized environments.

No malware or executable supply-chain behavior is present in the supplied documentation. It describes authorized security-testing workflows, but several recommendations enable credential access, coercion, exploitation, and potential file exfiltration if run without authorization. The fragment should be treated as high-impact offensive-security guidance rather than malicious package code.

SUSPICIOUS: the skill is internally coherent as a penetration-testing skill, but it grants an AI agent powerful offensive security capabilities against live enterprise infrastructure and references several third-party tools/binaries with uneven install trust. The main issue is not hidden exfiltration; it is the high-risk offensive scope, credential-handling, and partial reliance on GitHub binaries/git-clone tooling.

This is an offensive privilege-escalation and Active Directory compromise playbook. It does not itself contain executable malware, but it provides detailed commands for unauthorized elevation, credential theft, domain takeover, persistence-related attribute changes, and remote execution. Malware probability is low for the supplied text; operational security risk is high.

This is an offensive lateral-movement reference containing actionable instructions for credential abuse, remote execution, tunneling, Active Directory compromise, and evasion. It is not executable malware by itself and shows no direct autonomous data exfiltration or persistence, but executing the commands presents a high security risk in an unauthorized environment.

This is dual-use Impacket operational documentation. It is not itself malware or executable code, and no obfuscated payload or unauthorized network destination is present. If the commands are run with appropriate authorization, they support security assessment activities; otherwise, they can enable credential theft, lateral movement, privilege escalation, and domain compromise. The document should be treated as sensitive offensive-security guidance and used only in authorized environments.

This is an offensive credential-attack playbook, not conventional package malware. It contains actionable procedures for password spraying, authentication interception and relay, Kerberos roasting, credential dumping, and hash cracking. The content presents a high security risk if used outside an explicitly authorized assessment, although no self-executing malware, exfiltration endpoint, persistence mechanism, or obfuscated payload is shown.

This is an explicit Active Directory domain-compromise and persistence-demonstration procedure. It is not malware code or an npm package payload, and it shows no obfuscation or covert exfiltration. However, the commands directly extract domain secrets, forge authentication tickets, obtain DPAPI and CA private keys, and modify privileged directory or host state. It should only be used under separately documented authorization and strict change control; the security risk of executing it is extremely high.

This is an offensive Active Directory reconnaissance and attack-path enumeration runbook. It does not itself show malware or covert malicious behavior, but it collects highly sensitive AD intelligence and explicitly supports escalation toward Domain Admins, credential attacks, lateral movement, and DCSync. Use should be limited to authorized environments. Command-line credential handling and unencrypted LDAP are notable security weaknesses.

This is an offensive AD security reference containing actionable dual-use attack procedures and tooling, but it is not malware and has no executable behavior in the supplied fragment. Unauthorized use could enable credential theft, domain takeover, and persistence; use should be limited to explicitly authorized assessments or lab environments.

The fragment describes an authorized network-reconnaissance workflow and contains no clear malware or supply-chain backdoor behavior. It does perform potentially intrusive scanning and anonymous protocol enumeration, and it fails to enforce the documented exclusions, creating a significant authorization and operational-safety concern. The credential-attack workflow is only referenced, not executed here.

The fragment is an operational guide for Responder and ntlmrelayx-based credential interception and relay. It contains no evident malware or obfuscation as source text, but the described configurations are highly capable offensive network actions and create substantial security risk if used outside an explicitly authorized, isolated scope.

This is a high-risk offensive lateral-movement workflow. It may be legitimate red-team or penetration-testing documentation when tightly authorized and scoped, but it directly enables credential harvesting, pass-the-hash, Domain Admin session targeting, remote execution, and privilege escalation. The text itself does not demonstrate package malware or unauthorized exfiltration, but its operational behavior would be dangerous if executed outside an authorized engagement.