The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides functional command examples for downloading and executing remote code via standard system binaries.
Evidence: usage of certutil and mshta to fetch and execute payloads from remote URLs.
Evidence: Use of msbuild.exe to execute inline C# tasks from remote or local XML files.
[DYNAMIC_EXECUTION]: Contains technical logic for bypassing endpoint security by patching system memory at runtime and resolving kernel syscalls dynamically.
Evidence: Memory patching instructions for AmsiScanBuffer to disable the Antimalware Scan Interface.
Evidence: Patching EtwEventWrite to prevent activity from being logged via Event Tracing for Windows.
Evidence: Reference to dynamic syscall resolution techniques like HellsGate and HalosGate to evade EDR hooks.
[DATA_EXFILTRATION]: Outlines methodologies for removing data from a target environment, including specific exfiltration scripts.
Evidence: Python code snippet demonstrating how to chunk data for exfiltration through DNS TXT queries.
Evidence: Instructions for staging and transferring encrypted data via SCP and GPG.
[COMMAND_EXECUTION]: Promotes the use of Living Off the Land Binaries (LOLBins) to execute malicious actions while avoiding detection.
Evidence: Documentation of techniques using rundll32.exe, regsvr32.exe, and wmic.exe for process creation and code execution.
[CREDENTIALS_UNSAFE]: Includes a hardcoded password within a configuration template example.
Evidence: The malleable C2 profile example uses set password "changeit"; for keystore authentication.
[PRIVILEGE_ESCALATION]: Describes methods for obtaining elevated permissions on a target host.
Evidence: Technical references to UAC bypass techniques and Token manipulation.
[PERSISTENCE]: Covers common techniques for maintaining persistent access across system reboots.
Evidence: Instructions for creating unauthorized scheduled tasks and modifying registry Run keys for persistence.

offensive-advanced-redteam