The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions include specific commands for invoking powerful security tools such as Mimikatz and the Impacket suite (secretsdump.py, ticketer.py, psexec.py). These commands are designed to extract password hashes, forge Kerberos tickets, and execute code on remote systems.
[PRIVILEGE_ESCALATION]: The workflow describes methods for escalating privileges within an Active Directory environment, specifically by modifying Access Control Lists (ACLs) using PowerView's Add-DomainObjectAcl to grant replication rights to unauthorized accounts and using ntlmrelayx.py for automated privilege escalation.
[PERSISTENCE]: The skill documents techniques for maintaining long-term access to a domain, including the extraction of the KRBTGT hash for Golden Ticket forging and the intentional modification of domain root permissions to create persistent replication backdoors.
[INDIRECT_PROMPT_INJECTION]: The provided scripts (agent.py and process.py) ingest and process external data sources such as Windows event logs and tool outputs, which represents a potential attack surface if processed data contains malicious instructions.
Ingestion points: scripts/agent.py (Windows Security event log JSON files) and scripts/process.py (secretsdump output text files).
Boundary markers: None identified in the provided code to distinguish between data and instructions.
Capability inventory: agent.py performs authenticated LDAP queries; process.py performs file write operations for reporting.
Sanitization: Processing is limited to basic JSON parsing and regular expression matching without explicit sanitization or instruction filtering.

conducting-domain-persistence-with-dcsync