The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides specific instructions for bypassing User Account Control (UAC) by modifying registry keys under the HKCU hive to hijack execution flows of trusted binaries like fodhelper.exe and eventvwr.exe.- [COMMAND_EXECUTION]: Includes commands for service exploitation that allow an agent to reconfigure service binary paths using sc config or replace existing service binaries with arbitrary code.- [COMMAND_EXECUTION]: Contains instructions for establishing persistent access to a system by creating new scheduled tasks configured to run with SYSTEM-level privileges.- [DATA_EXFILTRATION]: Provides commands to access and save sensitive registry hives, specifically HKLM\SAM and HKLM\SYSTEM, which contain local account security information and password hashes for offline cracking.- [CREDENTIALS_UNSAFE]: Directs the agent to utilize specialized offensive tools like Mimikatz and Rubeus to harvest cleartext passwords, Kerberos tickets, and NTLM hashes from memory and the Data Protection API (DPAPI).

privesc-windows