windows-lateral-movement

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes numerous command examples that embed plaintext passwords, NTLM hashes, Kerberos tickets/ccache names, AES keys, and base64 ticket blobs directly in commands, which would require an LLM to handle or output secret values verbatim if used with real secrets.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This repository is clearly a malicious attack playbook: it provides step‑by‑step techniques for unauthorized Windows lateral movement, credential dumping, pivoting, and persistence that enable system compromise, credential theft, and data exfiltration.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill contains explicit instructions to create services, modify HKLM registry keys, run credential-dumping tools (Mimikatz), and use sudo to change routing—actions that require elevated privileges and modify system state to enable lateral movement and persistence.