The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides multiple command patterns for downloading and immediately executing code from remote, untrusted servers.
Evidence: Instructions for using mshta, certutil, bitsadmin, and PowerShell IEX to download and run payloads from attacker.com.
Evidence: Usage of regsvr32 and mshta to execute remote scriptlets (.sct files).
[COMMAND_EXECUTION]: Extensive documentation of commands used to modify system configuration, establish persistence, and perform lateral movement.
Evidence: Creation of Windows Scheduled Tasks, Registry Run keys, and WMI event subscriptions for persistence.
Evidence: Modification of Linux authorized_keys, cron jobs, and systemd services.
Evidence: Use of wmic and winrs for executing commands on remote network nodes.
[DATA_EXFILTRATION]: Explicit instructions for transferring data out of a compromised environment.
Evidence: Methods for DNS exfiltration using subdomains to tunnel data.
Evidence: Instructions for uploading data to external cloud storage and paste sites.
[CREDENTIALS_UNSAFE]: Provides techniques for harvesting and extracting sensitive credentials from memory and disk.
Evidence: Usage of mimikatz for dumping SAM databases, LSA secrets, and performing Domain Controller synchronization (DCSync) attacks.
Evidence: Accessing sensitive system files like /etc/passwd and /etc/shadow patterns.
[EXTERNAL_DOWNLOADS]: Leverages native system utilities (Living off the Land binaries) to fetch external content from non-whitelisted domains.

red-team-ops