The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill implements 'Bring Your Own Vulnerable Driver' (BYOVD) techniques (T129-T144) designed to load signed but vulnerable kernel drivers. These are used to achieve Ring 0 execution, disable Driver Signature Enforcement (DSE), and bypass LSA protection.
[EXTERNAL_DOWNLOADS]: The skill references 'https://www.loldrivers.io' (T144), which is a blacklisted URL used for sourcing vulnerable drivers for exploitation. Automated scanners have confirmed this URL as malicious.
[REMOTE_CODE_EXECUTION]: Provides templates and methods for downloading and executing shellcode from remote servers (T051, T094), including fetching clean system DLLs from remote C2 servers to bypass local hooks. Additionally, automated scanners flagged the 'references/evasion-techniques-db.json' technical database as malicious (FileRepMalware).
[COMMAND_EXECUTION]: The agent is instructed to use bash for cross-compilation of the generated malicious loaders to verify their functionality.
[PERSISTENCE]: The technical database includes methods for maintaining system access via Windows Scheduled Tasks (T059).
[OBFUSCATION]: The skill provides comprehensive implementation patterns for API hashing (T003, T163), string XOR encryption (T004), and shellcode encoding (T009, T081) to hide malicious intent from security scanners.
[DYNAMIC_EXECUTION]: Utilizes sophisticated execution vectors such as Direct and Indirect Syscalls (T001, T002, T159), Reflective DLL Injection (T031), and Return Oriented Programming (ROP) gadgets (T100) to execute code in memory without traditional file-based footprints.
[INDIRECT_PROMPT_INJECTION]: The skill accepts user-supplied loader source code as input for modification, creating an attack surface where instructions embedded in external code could influence the agent's behavior during the integration process.

evasion-technique-integrate