The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/agent.py uses the subprocess.run function to execute reg query commands. This functionality is part of the audit_dcom_config feature, which checks the local Windows registry for the registration of specific high-risk DCOM objects. The commands utilize static registry paths and a hardcoded list of class identifiers (CLSIDs).
[INDIRECT_PROMPT_INJECTION]: The scripts scripts/agent.py and scripts/detect_dcom_lateral_movement.py ingest and process Sysmon and Windows Security log files, which are external data sources potentially influenced by an adversary.
Ingestion points: Event log files are ingested through the --evtx and --security command-line arguments.
Boundary markers: The scripts utilize specialized libraries (python-evtx and lxml) for structured XML parsing, but they do not use specific delimiters or instructions to isolate the parsed data when generating reports.
Capability inventory: The skill possesses capabilities for reading local log files, performing registry queries via subprocess, and writing JSON analysis reports to the file system.
Sanitization: The scripts extract process metadata and command-line strings from logs for analysis and reporting but do not perform deep sanitization of these values before including them in the final output.
[EXTERNAL_DOWNLOADS]: The skill documentation and script comments recommend the installation of the python-evtx and lxml packages from standard software registries to enable log parsing capabilities.

hunting-for-dcom-lateral-movement