kerberos-advanced-attack

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). Contains many commands and examples that explicitly place plaintext secrets (passwords, krbtgt hashes, AES keys, PFX passwords, AS-REP keys, etc.) directly into command-line arguments or code, requiring the model to handle and reproduce secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an explicit offensive Kerberos escalation playbook: it instructs step‑by‑step credential theft (NT hashes, DCSync), ticket forgery (Golden/Sapphire/RODC tickets), relays and MITM techniques, RODC/DACL tampering and methods to obtain remote shells — clearly intended for unauthorized privilege escalation and data exfiltration.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). 该技能描述并指示创建/重命名机器账户、修改 SPN 与 AD 对象/DACL、配置 RBCD 与 RODC PRP、执行 DCSync/票据伪造等一系列需要提升/写入域/系统状态的操作，明确推动对运行主机或域环境的破坏性修改，因此应被标记。