active-directory-kerberos-attacks

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill contains numerous CLI examples that require embedding plaintext passwords, NTLM/krbtgt hashes, and ticket blobs directly into commands (e.g., DOMAIN/user:password, KRBTGT_HASH, NTLM_HASH, base64_ticket_blob), which forces an LLM to handle or output secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This is an explicit offensive Kerberos/Active Directory attack playbook with step-by-step commands for credential theft, ticket forging, lateral movement, and DCSync capability—clearly intended for abusive compromise and persistence.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs creating AD machine accounts, forging and injecting Kerberos tickets, and running credential-dumping/privilege-escalation tools (e.g., addcomputer.py, ticketer.py, Mimikatz, psexec, sekurlsa::pth), all of which perform state-changing actions and bypass security controls.