The Agent Skills Directory

[COMMAND_EXECUTION]: Provides explicit instructions for establishing persistence on Windows systems using registry run keys (reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Update" /d "C:\path\payload.exe") and scheduled tasks (schtasks /create /tn "SystemUpdate" /tr "C:\path\payload.exe" /sc onlogon /ru SYSTEM).
[COMMAND_EXECUTION]: Contains persistence mechanisms for Linux environments, including malicious cron jobs (echo "* * * * * /tmp/.backdoor" | crontab -), systemd service creation, and modification of SSH authorized keys to allow unauthorized remote access.
[REMOTE_CODE_EXECUTION]: Details multiple techniques for remote payload delivery and execution using Living off the Land (LOLBins) binaries, such as mshta, certutil, bitsadmin, regsvr32, and PowerShell Invoke-Expression (IEX) targeting external infrastructure.
[CREDENTIALS_UNSAFE]: Provides commands to harvest highly sensitive credentials using mimikatz, including extraction of plaintext passwords from memory (sekurlsa::logonpasswords), dumping the SAM database, and performing DCSync attacks to compromise Active Directory domains.
[COMMAND_EXECUTION]: Includes multiple privilege escalation techniques, such as exploiting SeImpersonatePrivilege via PrintSpoofer, abusing unquoted service paths, and exploiting SUID binaries or sudo misconfigurations on Linux.
[DATA_EXFILTRATION]: Outlines methods for exfiltrating data through stealthy channels, including DNS tunneling (encoding data in subdomains) and HTTPS uploads to external repositories and paste sites.
[REMOTE_CODE_EXECUTION]: Instructs the agent in advanced execution and evasion techniques including kernel module insertion (insmod rootkit.ko), process injection, DLL sideloading, and unhooking security monitoring tools.

red-team-ops