abusing-adcs

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt shows multiple example commands that pass passwords on the command line (e.g., -p 'Password'), which requires embedding secret values verbatim in generated commands/outputs and is high-risk secret handling.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document provides explicit, actionable offensive techniques for credential theft, CA private-key extraction, certificate forgery, and relay-based domain compromise enabling persistent backdoors and privilege escalation.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs modifying AD CS templates, changing CA configuration, and extracting CA private keys (e.g., certipy template, certipy ca -backup), which are actions that change system/domain state and can compromise machines.