ad-persistence

MALICIOUS. The skill’s stated purpose is to help an AI agent establish stealthy AD persistence after compromise, including credential theft, ticket forgery, directory backdoors, evasion, and cleanup. Its capabilities are inherently incompatible with benign enterprise administration, and it routes sensitive secrets into offensive third-party tools with uneven provenance.

This is not executable malware or a package implementation; it is an operational offensive-security guide. It provides highly actionable instructions for credential theft, forged authentication, domain persistence, session hijacking, and NTLM capture/relay. If distributed as documentation in a security-training or authorized red-team context, its presence is explainable, but executing the commands against systems without authorization would create severe security impact. The fragment alone does not demonstrate autonomous malicious behavior or supply-chain compromise.

This fragment is an offensive Windows persistence playbook rather than ordinary application functionality. It contains no direct execution or data theft in the shown text, but provides ready-to-use commands for DLL hijacking, service persistence, WMI backdoors, and hidden PowerShell startup execution. It should not be included in a normal software package unless the package is explicitly a security-testing tool with strong justification and controls.

The supplied fragment is documentation rather than executable source code. It does not directly perform malware actions, collect data, or establish persistence when merely stored or viewed. However, it provides detailed, actionable instructions for abusing Active Directory replication, gMSA secrets, Kerberos delegation, RBCD, and PAM/Shadow Principal configuration to establish covert privileged persistence. It should be treated as high-risk offensive content and restricted to authorized security testing environments.