post-exploit-windows
Fail
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: CRITICALCREDENTIALS_UNSAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONOBFUSCATIONPRIVILEGE_ESCALATIONPERSISTENCEDYNAMIC_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs how to download and execute scripts directly into memory using PowerShell's IEX (Invoke-Expression) command, bypassing file-based detection systems. Evidence is found in references/ad-privesc-techniques.md.- [PRIVILEGE_ESCALATION]: Documents multiple techniques to elevate permissions from a low-privilege user to SYSTEM, including UAC bypass via fodhelper.exe, token impersonation using the Potato tool family, and exploiting print spooler vulnerabilities like CVE-2021-34527.- [CREDENTIALS_UNSAFE]: Provides commands for dumping sensitive local and domain credentials from registry hives (SAM/SYSTEM) and process memory (LSASS).- [OBFUSCATION]: Employs string concatenation to hide calls to the Anti-Malware Scan Interface (AMSI), a technique used by malware to evade security software.- [DYNAMIC_EXECUTION]: Uses C# assembly injection and memory manipulation (VirtualProtect, Marshal.Copy) to patch system security buffers at runtime.- [PERSISTENCE]: Explains how to maintain long-term access by creating backdoor users and modifying system AutoRun registry keys.- [COMMAND_EXECUTION]: The skill facilitates the execution of dangerous administrative commands and third-party offensive binaries.
Recommendations
- CRITICAL: 1 infected file(s) detected - DO NOT USE
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- AI detected serious security threats
Audit Metadata