The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides numerous examples of executing sensitive security tools to compromise identity infrastructure.
Instructions include using lsadump::dcsync in Mimikatz to extract domain-wide credentials.
Usage of AADInternals, Rubeus, Impacket, and adconnectdump is detailed for token manipulation and remote credential extraction.
[PRIVILEGE_ESCALATION]: The methodology describes techniques to gain administrative control over both cloud and on-premises environments.
Explicit instructions for using privilege::debug and token::elevate to interact with LSASS and system tokens.
Procedures for exploiting Group Managed Service Accounts (gMSA) and modifying administrative group memberships like AAD DC Administrators.
[PERSISTENCE]: The skill documents methods for maintaining long-term access to the target environment.
Instructions for installing the PTASpy backdoor to intercept plaintext passwords and bypass authentication.
Methodology for registering malicious Pass-Through Authentication (PTA) Agents and forging Golden SAML tokens.
[DATA_EXFILTRATION]: Detailed procedures are provided for harvesting and using sensitive credentials.
Techniques to extract Primary Refresh Tokens (PRT) and session keys from memory.
Methods for capturing browser session cookies (ESTSAUTH, ESTSAUTHPERSISTENT) and JWT tokens from process memory to bypass Multi-Factor Authentication (MFA).
[EXTERNAL_DOWNLOADS]: The skill relies on external, unverifiable scripts and modules to perform its functions.
References to shimit.py, adconnectdump.py, modifyuser.py, and partialtofulltgt.py which are not included in the skill package.
Instructions to install external PowerShell modules such as AADInternals.

azure-hybrid-lateral