Skip to content

Commit 7065b5c

Browse files
M09Icclaude
M09Ic
and
claude
committed
docs(skills): rewrite all skills in English and fix cross-file references
Convert all 25 skill files (4 SKILL.md + 21 reference files) from Chinese to English. Add anchor-based cross-references between phase files and the two canonical reference files (technique-reference.md, opsec-guide.md). Add canonical-reference header to opsec-guide.md. Remove stale $ARGUMENTS placeholders from iom-pentest and iom-opsec SKILL.md. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent 229fd77 commit 7065b5c

25 files changed

Lines changed: 3368 additions & 0 deletions

‎skills/iom-opsec/SKILL.md‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
---
2+
name: iom-opsec
3+
description: >
4+
IoM Operational Security (OPSEC) advisor. Provides OPSEC methodology guidance,
5+
helps users understand operational risks, build secure operating habits, and
6+
accumulate experience through a case library. Does not execute commands directly;
7+
serves as decision support. Concrete technical specifications and OPSEC scoring
8+
are maintained in the iom-pentest skill.
9+
Trigger conditions: use when the user asks "is this safe?", "will this be detected?",
10+
"how should I think about OPSEC?", "risk assessment", "operational security advice",
11+
or "help me analyze the detection surface".
12+
---
13+
14+
# IoM OPSEC Advisor
15+
16+
Provides operational security methodology guidance. Does not duplicate concrete technical
17+
specifications (command usage, OPSEC scores, AV countermeasure matrices) — those are
18+
maintained centrally in the iom-pentest references. This skill focuses on **mindset and
19+
decision frameworks**.
20+
21+
## Methodology: Five Questions Before Every Operation
22+
23+
Answer these five questions before executing any operation:
24+
25+
**1. Do I know what is on the other side?**
26+
Do not execute any risky operation without first running `enum av` / `ps`. Operating blind is the number-one OPSEC killer.
27+
28+
**2. What is the detection surface of this operation?**
29+
Every operation has a detection surface. Understanding it is the prerequisite for assessing risk:
30+
31+
| Detection Dimension | Trigger Source | Monitored By |
32+
|---------------------|---------------|--------------|
33+
| Process creation | New process, anomalous parent-child relationship | EDR, Sysmon Event 1 |
34+
| Memory operations | Process injection, cross-process read/write | EDR kernel callbacks |
35+
| File on disk | Files written to disk | AV real-time scanning |
36+
| Registry | Run keys, service registration | Sysmon Event 12/13 |
37+
| Network | Anomalous outbound traffic, lateral movement ports | NDR, firewall |
38+
| Credential access | LSASS access | Credential Guard, EDR |
39+
| Logging | ETW providers | SIEM, Defender ATP |
40+
| API calls | Sensitive ntdll/kernel32 calls | EDR inline hooks |
41+
42+
**3. Is there an alternative with a smaller detection surface?**
43+
Almost always yes. If your first instinct is `logonpasswords`, consider whether `hashdump` is sufficient.
44+
45+
**4. What if it fails?**
46+
Being blocked is not the same as being discovered, but retrying the same technique is self-exposure. Plan a fallback path.
47+
48+
**5. Is this step actually necessary?**
49+
If you can skip it, skip it. Every operation carries risk.
50+
51+
## HITL Decision Framework
52+
53+
Triage user-requested operations by severity level:
54+
55+
**Green Light (execute directly, inform the user)**
56+
- Read-only information gathering: sysinfo, whoami, ps, enum av
57+
- Status checks: session, listener, pipeline list
58+
- These operations have a minimal detection surface, but it is still worth telling the user what is happening
59+
60+
**Yellow Light (present options, wait for confirmation)**
61+
- Operations with multiple implementation paths that differ significantly in OPSEC impact
62+
- Privilege escalation, credential harvesting, persistence
63+
- Present at least two options, annotating the detection surface of each
64+
65+
**Red Light (strong warning, explicit confirmation required)**
66+
- Operations with an OPSEC score < 6
67+
- Techniques known to be blocked by the current AV (per the case library)
68+
- Operations that may destabilize the system (kernel exploits)
69+
- Clearly state the risk, recommend alternatives, and wait for the user to explicitly confirm
70+
71+
## Case Library
72+
73+
The case library is the core of experience accumulation. Each case records the outcome of a specific operation in a specific environment, serving as a reference for future decisions.
74+
75+
Cases are stored in the `reference/cases/` directory, named as `<operation-type>-<security-product>.md`.
76+
See [reference/case-template.md](reference/case-template.md) for the case format.
77+
78+
### Using Cases
79+
80+
When a user requests an operation:
81+
1. Identify the security products in the target environment
82+
2. Search the case library for `<operation-type>-<security-product>.md`
83+
3. If a matching case exists, cite the historical conclusion and skip techniques known to fail
84+
4. If no matching case exists, assess per the methodology, execute, and record the result as a new case
85+
86+
### Iteration Mechanism
87+
88+
Cases feed back into the iom-pentest references:
89+
- A technique is consistently blocked by a specific AV — update the [strategy matrix](../iom-pentest/reference/opsec-guide.md#strategy-matrix) in `opsec-guide.md`
90+
- A new safe execution path is discovered — update the corresponding [phase reference](../iom-pentest/reference/) in iom-pentest
91+
- AV product behavior changes — update the [security product identification table](../iom-pentest/reference/opsec-guide.md#security-product-identification) in `opsec-guide.md`
92+
93+
This way the case library drives iterative improvement of the iom-pentest specifications, rather than maintaining duplicates in both places.
94+
95+
## References
96+
97+
| Content | Location |
98+
|---------|----------|
99+
| Case template | [reference/case-template.md](reference/case-template.md) |
100+
| Case library | [reference/cases/](reference/cases/) |
101+
| AV countermeasures and execution methods (detailed specs) | iom-pentest/reference/opsec-guide.md — [Strategy Matrix](../iom-pentest/reference/opsec-guide.md#strategy-matrix), [Execution Method Selection](../iom-pentest/reference/opsec-guide.md#execution-method-selection) |
102+
| Technique quick-reference and OPSEC scores | iom-pentest/reference/technique-reference.md — [Credential Harvesting](../iom-pentest/reference/technique-reference.md#credential-harvesting), [UAC Bypass](../iom-pentest/reference/technique-reference.md#uac-bypass) |

‎skills/iom-opsec/reference/case-template.md‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
# OPSEC Case Template
2+
3+
Each case records the full context of a real operation, serving as a reference for similar future scenarios.
4+
5+
## Case File Naming
6+
7+
Format: `<operation-type>-<security-product>.md`
8+
9+
Examples:
10+
- `cred-dump-defender.md` — credential harvesting in a Defender environment
11+
- `uac-bypass-crowdstrike.md` — UAC bypass in a CrowdStrike environment
12+
- `lateral-wmi-no-av.md` — WMI lateral movement with no AV present
13+
14+
## Case Structure
15+
16+
```markdown
17+
# [Short Title]
18+
19+
## Environment
20+
21+
| Item | Value |
22+
|------|-------|
23+
| OS | Windows 10 21H2 x64 |
24+
| AV/EDR | [Security product name and version] |
25+
| Privileges | [Medium/High/SYSTEM] |
26+
| Domain | [WORKGROUP/domain name] |
27+
| Patch level | [Last KB date] |
28+
29+
## Objective
30+
31+
[What operation needs to be accomplished]
32+
33+
## Attempts
34+
35+
### Attempt 1: [Technique Name] — [Success/Failure/Blocked]
36+
37+
Command:
38+
```
39+
[Actual command executed]
40+
```
41+
42+
Result: [Success/Failure/Detected]
43+
Analysis: [Why it succeeded or failed]
44+
45+
### Attempt 2: [Technique Name] — [Success/Failure/Blocked]
46+
47+
...
48+
49+
## Final Solution
50+
51+
[The approach that ultimately succeeded, or the conclusion if all approaches failed]
52+
53+
## Lessons Learned
54+
55+
- [Key finding 1]
56+
- [Key finding 2]
57+
- [Recommendations for subsequent operations]
58+
59+
## Tags
60+
61+
`[Security Product]` `[Operation Type]` `[OPSEC Score]` `[Success/Failure]`
62+
```
63+
64+
## Case Accumulation
65+
66+
After each operation conducted through the iom-opsec skill, if the result has reference value (especially failed cases), it should be recorded as a new case and stored in the `reference/cases/` directory.
67+
68+
Characteristics of a valuable case:
69+
- A technique was blocked by a specific AV (can be skipped directly in the future)
70+
- A detection blind spot was discovered in a specific AV
71+
- An unconventional but effective operation path was found
72+
- A recovery strategy after a failed operation

‎skills/iom-opsec/reference/cases/cred-dump-defender.md‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
# Credential Harvesting in a Defender Environment
2+
3+
## Environment
4+
5+
| Item | Value |
6+
|------|-------|
7+
| OS | Windows 10 21H2 x64 |
8+
| AV/EDR | Windows Defender (MsMpEng.exe) |
9+
| Privileges | High (Admin, UAC bypassed) |
10+
| Domain | CONTOSO.LOCAL |
11+
| Patch level | 2024-01 |
12+
13+
## Objective
14+
15+
Obtain local and domain credentials (hashes + plaintext)
16+
17+
## Attempts
18+
19+
### Attempt 1: hashdump — Success
20+
21+
```
22+
hashdump
23+
```
24+
25+
Result: Success — local SAM hashes obtained
26+
Analysis: hashdump does not touch LSASS; Defender did not detect it. OPSEC 9.0.
27+
28+
### Attempt 2: logonpasswords — Blocked
29+
30+
```
31+
logonpasswords
32+
```
33+
34+
Result: Blocked by Defender real-time protection
35+
Analysis: logonpasswords reads LSASS memory directly; Defender has dedicated protection rules for LSASS access. OPSEC 5.9, as expected.
36+
37+
### Attempt 3: nanodump --fork --spoof-callstack — Success
38+
39+
```
40+
nanodump --fork --spoof-callstack
41+
```
42+
43+
Result: Success — LSASS dump obtained
44+
Analysis: Fork mode creates a copy of the LSASS process rather than reading it directly; spoof-callstack conceals the call stack. Defender did not detect it.
45+
46+
### Attempt 4: credman — Success
47+
48+
```
49+
credman
50+
```
51+
52+
Result: Success — credentials saved in Credential Manager obtained
53+
Analysis: Reads the current user's Credential Manager; no special privileges required. OPSEC 9.0.
54+
55+
## Final Solution
56+
57+
1. `hashdump` to obtain local hashes (OPSEC 9.0)
58+
2. `credman` to obtain saved credentials (OPSEC 9.0)
59+
3. `nanodump --fork --spoof-callstack` to obtain domain credentials (OPSEC 8.0)
60+
61+
No need to use logonpasswords or mimikatz.
62+
63+
## Lessons Learned
64+
65+
- logonpasswords is invariably blocked under Defender — skip it entirely
66+
- The nanodump fork + spoof-callstack combination is the best option for obtaining LSASS credentials under Defender
67+
- Prefer methods that do not touch LSASS (hashdump, credman, klist)
68+
69+
## Tags
70+
71+
`Defender` `Credential Harvesting` `OPSEC-8.0+` `Success`

‎skills/iom-pentest/SKILL.md‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
---
2+
name: iom-pentest
3+
description: >
4+
Autonomous penetration testing via IoM C2 MCP tools. Adaptively executes based on user intent:
5+
situational awareness, reconnaissance, privilege escalation, credential harvesting, lateral movement,
6+
persistence, and more. Presents an execution plan and waits for user confirmation before sensitive operations.
7+
Trigger conditions: user mentions penetration testing, red team, post-exploitation, privilege escalation,
8+
lateral movement, credentials, persistence, situational awareness, or any scenario involving security
9+
assessment of a target through IoM.
10+
---
11+
12+
# IoM Automated Penetration Testing
13+
14+
Autonomous penetration testing via IoM MCP tools. The core methodology is the **OODA Loop** — Observe, Orient, Decide, Act — adapting to the actual environment and user intent.
15+
16+
## Intent Recognition and Interaction
17+
18+
This skill does not rely on fixed keywords or rigid phase workflows. It interprets the user's natural language to understand intent and flexibly combines capabilities to accomplish the task.
19+
20+
**When intent is clear**: Formulate an execution plan directly, present it to the user for confirmation, then execute.
21+
22+
**When intent is ambiguous**: Proactively ask the user to clarify the objective. For example:
23+
- User says "work on this machine" — Ask: Do you need privilege escalation, credential harvesting, or a full reconnaissance sweep?
24+
- User says "check things out" — Could be a situational overview or targeted reconnaissance on a specific session; confirm the scope.
25+
- User provides a session ID with no further instructions — Ask what the objective is.
26+
27+
**Plan presentation**: For any non-read-only operation, output an execution plan (including the commands to run, targets, and risk assessment) and wait for user confirmation before proceeding.
28+
29+
## HITL (Human-in-the-Loop) Rules
30+
31+
The need for user confirmation depends on the sensitivity of the operation:
32+
33+
### No Confirmation Required (Read-Only / Information Gathering)
34+
- Viewing session, listener, and pipeline status
35+
- System information gathering: `sysinfo`, `whoami`, `privs`, `ps`, `ipconfig`, `netstat`
36+
- Environment enumeration: `enum av`, `enum software`, `systeminfo`
37+
- Network discovery: `pingscan`, `portscan`
38+
- Domain information queries: `ldapsearch`, `klist`, `enum dc`
39+
40+
### Confirmation Required (Alters Target State or Carries Detection Risk)
41+
- Privilege escalation (UAC bypass, Potato, kernel exploits)
42+
- Credential extraction (hashdump, logonpasswords, mimikatz, nanodump)
43+
- Lateral movement (psexec, wmi, dcom, ptt)
44+
- Persistence installation (registry, service, scheduled task)
45+
- Any operation that writes files, creates processes, or modifies configuration
46+
47+
### OPSEC Score Alerts
48+
Each technique carries an OPSEC safety score (1-10; higher is safer):
49+
- **>= 8**: Listed normally in the plan
50+
- **6-8**: **Risk level annotated** in the plan
51+
- **< 6**: **Mandatory separate alert** explaining the risk and recommending a safer alternative
52+
53+
## MCP Tools and Progressive Discovery
54+
55+
IoM has hundreds of commands — do not guess command usage. Use **progressive discovery** to retrieve information on demand:
56+
57+
1. **Search for commands** — `search_commands` performs a fuzzy keyword search and returns command summaries (name, group, description, OPSEC score)
58+
2. **View usage** — `execute_command("<cmd> --help")` retrieves the specific command's parameters and examples
59+
3. **Execute the command** — Only run the command via `execute_command` after confirming usage
60+
61+
### Available MCP Tools
62+
63+
| Tool | Purpose |
64+
|------|---------|
65+
| `search_commands` | Fuzzy search commands by name/description; returns lightweight summaries |
66+
| `execute_command` | Execute any client/implant command; automatically waits for results |
67+
| `get_history` | Retrieve historical task output |
68+
69+
### Basic Operations
70+
71+
- **Switch session**: `execute_command("use <session_id_prefix>")` — enters the implant context
72+
- **Implant commands**: After switching, execute `sysinfo`, `whoami`, `ps`, etc. directly
73+
- **Client commands**: `session`, `listener`, `pipeline list`, etc. do not require a session context
74+
- **Task results**: `execute_command` automatically waits and returns results
75+
76+
### Example: Progressive Discovery Workflow
77+
78+
```
79+
# 1. Unsure which privilege escalation commands exist — search
80+
search_commands("uac")
81+
search_commands("elevate")
82+
83+
# 2. Found uac-bypass command — view detailed usage
84+
execute_command("uac-bypass --help")
85+
86+
# 3. Understood the parameters — execute
87+
execute_command("uac-bypass elevatedcom \"C:\\path\\to\\implant.exe\"")
88+
```
89+
90+
## Core Principles
91+
92+
1. **Observe before acting** — Never execute blindly; adjust strategy based on environmental data
93+
2. **OPSEC first** — Identify defenses before selecting evasion techniques. See [reference/opsec-guide.md](reference/opsec-guide.md)
94+
3. **Pivot on failure** — If a technique is blocked, mark it and switch paths; never retry the same technique
95+
4. **Minimum footprint** — Prefer BOF over execute_assembly; avoid writing to disk when possible
96+
5. **Respect user decisions** — Present a plan and wait for confirmation on sensitive operations; offer alternatives if the user declines
97+
98+
## Capability Reference
99+
100+
Consult the appropriate reference document based on user intent:
101+
102+
| Scenario | Reference File | Key Sections |
103+
|----------|---------------|--------------|
104+
| Global situational awareness | [reference/phase-summary.md](reference/phase-summary.md) | |
105+
| Target reconnaissance and environment enumeration | [reference/phase-recon.md](reference/phase-recon.md) | |
106+
| Privilege escalation | [reference/phase-privesc.md](reference/phase-privesc.md) | UAC: [technique-reference.md#uac-bypass](reference/technique-reference.md#uac-bypass), Potato: [technique-reference.md#potato-privilege-escalation](reference/technique-reference.md#potato-privilege-escalation), Kernel: [technique-reference.md#kernel-exploits](reference/technique-reference.md#kernel-exploits) |
107+
| Credential harvesting | [reference/phase-creds.md](reference/phase-creds.md) | [technique-reference.md#credential-harvesting](reference/technique-reference.md#credential-harvesting) |
108+
| Lateral movement | [reference/phase-lateral.md](reference/phase-lateral.md) | [technique-reference.md#lateral-movement](reference/technique-reference.md#lateral-movement) |
109+
| Persistence | [reference/phase-persist.md](reference/phase-persist.md) | [technique-reference.md#persistence](reference/technique-reference.md#persistence) |
110+
| OPSEC strategy and AV evasion | [reference/opsec-guide.md](reference/opsec-guide.md) | [opsec-guide.md#execution-method-selection](reference/opsec-guide.md#execution-method-selection), [opsec-guide.md#strategy-matrix](reference/opsec-guide.md#strategy-matrix) |
111+
| Technique quick reference | [reference/technique-reference.md](reference/technique-reference.md) | |
112+
113+
## Output Report
114+
115+
Upon task completion, generate a structured report:
116+
117+
```markdown
118+
## Penetration Test Report
119+
**Date**: YYYY-MM-DD HH:MM
120+
**Target**: [session / host operated on]
121+
**Summary**: [what was actually performed]
122+
123+
### Attack Path
124+
[The actual execution path taken]
125+
126+
### Session Inventory
127+
| Session | Host | User | Privilege | Obtained Via |
128+
|---------|------|------|-----------|-------------|
129+
130+
### Harvested Credentials
131+
| Type | User | Domain | Source |
132+
|------|------|--------|--------|
133+
134+
### Techniques Used
135+
| MITRE ID | Technique | OPSEC | Result | Notes |
136+
|----------|-----------|-------|--------|-------|
137+
138+
### Defensive Gaps
139+
[Which weaknesses enabled the attack to succeed]
140+
```

0 commit comments

Comments
 (0)