Agent skill · security · yaklang
windows-lateral-movement
Windows lateral movement playbook. Use when pivoting between Windows hosts via PsExec, WMI, WinRM, DCOM, RDP, pass-the-hash, overpass-the-hash, or pass-the-ticket techniques.
Why this skill is useful
Adds detailed executable scripts and techniques for lateral movement in Windows environments that are not widely documented.
What it needs
Requires impacket installed locally. About 5k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Windows Lateral Movement — Expert Attack Playbook AI LOAD INSTRUCTION: Expert Windows lateral movement techniques. Covers PsExec, WMI, WinRM, DCOM, SMB, RDP, SSH, pass-the-hash, overpass-the-hash, pass-the-ticket, and pivoting. Base models miss execution method fingerprints, OPSEC trade-offs, and credential type requirements per method. 0. RELATED ROUTING Before going deep, consider loading: windows-privilege-escalation after landing on a new host for local escalation windows-av-evasion when EDR blocks lateral movement tools active-directory-kerberos-attacks for Kerberos-based lateral (pass-the-ticket, delegation) active-directory-acl-abuse for ACL-based paths to new hosts Advanced Reference Also load CREDENTIALDUMPING.md when you need: LSASS dump techniques (MiniDump, comsvcs.dll, nanodump) SAM/SYSTEM/SECURITY extraction DPAPI, credential manager, cached domain credentials NTDS.dit extraction methods --- 1. REMOTE EXECUTION METHODS COMPARISON Method Port Cred Type Creates Service? File on Disk? OPSEC Admin Required? --- --- --- --- --- --- --- PsExec 445 (SMB) Password/Hash Yes (PSEXESVC) Yes (.exe) Low Yes Impacket smbexec 445 Password/Hash Yes (temp service) No Medium Yes Impacket atexec 445 Password/Hash No (scheduled task) No Medium Yes WMI 135+dynamic Password/Hash No No High Yes WinRM 5985/5986 Password/Hash/Ticket No No High Yes (Remote Mgmt) DCOM 135+dynamic Password/Hash No No High Yes RDP 3389 Password/Hash (RestrictedAdmin) No No Low (GUI session) RDP access SSH 22 Password/Key No No High SSH enabled SC 445 Password/Hash Yes (custom service) Yes Low Yes --- 2. PSEXEC VARIANTS Impacket PsExec Impacket smbexec (Stealthier — No Binary Upload) Impacket atexec (Scheduled Task) Sysinternals PsExec --- 3. WMI LATERAL MOVEMENT --- 4. WINRM LATERAL MOVEMENT --- 5. DCOM LATERAL MOVEMENT Stealthy — uses legitimate COM objects, no service creation. MMC20.Application ShellWindows ShellBrowserWindow Impacket dcomexec --- 6. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/windows-lateral-movement