rtexit-method 0.1.0 → 0.1.2

package/packaged-assets/.agents/skills/rt-scenario-n003/SKILL.md

@@ -0,0 +1,100 @@
+---
+name: rt-scenario-n003
+description: "N-003: Active Directory attack-path mapping with BloodHound-style relationship analysis. Domain: network. Authorized scenario for identifying privilege paths, validating control gaps, and building remediation plans."
+---
+
+# N-003: Active Directory Attack Path Mapping
+
+## Overview
+
+This scenario evaluates whether normal or low-privileged domain relationships can create a path to high-value assets such as Domain Admins, server admins, backup systems, or sensitive file shares. It emphasizes graph analysis, safe validation, and remediation.
+
+| Field | Value |
+|---|---|
+| Domain | Active Directory |
+| Objective | Identify and prioritize privilege paths |
+| Required Access | Domain user or approved directory data export |
+| Detection Risk | Low to Medium |
+| Primary Impact | Privilege escalation and domain compromise path |
+
+## Prerequisites
+
+- Domain scope approved.
+- Collection method approved.
+- Account used for collection documented.
+- Sensitive group list agreed with client.
+- No privilege modification unless explicitly approved.
+
+## Attack Chain Model
+
+1. Collect directory relationship data.
+2. Import graph into analysis tooling.
+3. Identify paths from low privilege to high-value principals.
+4. Validate each edge with read-only evidence where possible.
+5. Recommend changes that break the path earliest.
+
+## Workflow
+
+### Step 1 - Define Crown Jewels
+
+Examples:
+
+- Domain Admins.
+- Enterprise Admins.
+- Backup operators.
+- Tier 0 servers.
+- CI/CD service accounts.
+- Sensitive file shares.
+
+### Step 2 - Collect Relationship Data
+
+Use the collection method approved by the client. Record collection time, account, domain, and data retention plan.
+
+### Step 3 - Analyze Paths
+
+Prioritize paths involving:
+
+- GenericAll / GenericWrite.
+- WriteDACL / WriteOwner.
+- AddMember rights.
+- Unconstrained or risky delegation.
+- Local admin paths to servers.
+- Kerberoastable privileged service accounts.
+- Stale privileged users.
+
+### Step 4 - Validate Safely
+
+For each edge, capture configuration evidence instead of changing privileges:
+
+| Edge | Safe Proof |
+|---|---|
+| Group membership control | ACL screenshot/export |
+| Local admin path | Client-approved admin mapping |
+| Delegation | AD attribute evidence |
+| Service account risk | SPN and privilege context |
+
+## MITRE ATT&CK Mapping
+
+| Phase | Tactic | Technique |
+|---|---|---|
+| Discovery | Discovery | Account Discovery |
+| Privilege Path | Privilege Escalation | Domain Policy Modification |
+| Access | Defense Evasion / Persistence | Valid Accounts |
+
+## Evidence
+
+- Path screenshot.
+- Edge details.
+- Affected principals.
+- Business owner if known.
+- Recommended break point.
+
+## Remediation
+
+- Remove unnecessary delegated rights.
+- Apply tiered administration.
+- Clean stale groups and users.
+- Limit local admin sprawl.
+- Review service account privileges.
+- Monitor changes to privileged ACLs and groups.
+

package/packaged-assets/.agents/skills/rt-scenario-n004/SKILL.md

@@ -0,0 +1,90 @@
+---
+name: rt-scenario-n004
+description: "N-004: Hash reuse and pass-the-hash risk assessment. Domain: network. Authorized scenario for evaluating credential hygiene, lateral movement controls, SMB protections, and remediation."
+---
+
+# N-004: Hash Reuse and Lateral Movement Risk
+
+## Overview
+
+This scenario assesses whether credential material from one host could enable access to other hosts due to local admin reuse, weak endpoint protections, missing SMB signing, or insufficient segmentation. Production credential use requires explicit authorization.
+
+| Field | Value |
+|---|---|
+| Domain | Network / Windows |
+| Objective | Evaluate lateral movement risk from credential reuse |
+| Required Access | Compromised test host or client-provided evidence |
+| Detection Risk | Medium |
+| Primary Impact | Lateral movement and sensitive data access |
+
+## Prerequisites
+
+- Host scope approved.
+- Credential testing rules approved.
+- Test credentials or lab evidence preferred.
+- SOC notification completed where required.
+- Cleanup and reporting process defined.
+
+## Attack Chain Model
+
+1. Initial endpoint access exposes credential material or local admin context.
+2. Same credential or hash works on other hosts.
+3. Attacker reaches file servers, admin servers, or management tools.
+4. Sensitive data or broader administrative access becomes available.
+
+## Safe Validation Workflow
+
+### Step 1 - Control Review
+
+Review:
+
+- Windows LAPS coverage.
+- Credential Guard.
+- LSASS protection.
+- Local admin group membership.
+- SMB signing.
+- Admin tiering.
+- Remote administration restrictions.
+
+### Step 2 - Reuse Analysis
+
+Prefer client-provided configuration or test credentials. Build a matrix:
+
+| Credential Class | Reused? | Host Count | Business Risk |
+|---|---|---:|---|
+| Local admin | [yes/no] | [count] | [risk] |
+| Service account | [yes/no] | [count] | [risk] |
+
+### Step 3 - Segmentation and Access Review
+
+Map which host classes can authenticate to which network zones.
+
+### Step 4 - Impact Statement
+
+State what a real attacker could reach if one endpoint is compromised.
+
+## MITRE ATT&CK Mapping
+
+| Phase | Tactic | Technique |
+|---|---|---|
+| Credential Use | Lateral Movement | Pass the Hash |
+| Remote Access | Lateral Movement | SMB/Windows Admin Shares |
+| Collection | Collection | Data from Network Shared Drive |
+
+## Evidence
+
+- LAPS coverage export.
+- Local admin inventory.
+- SMB signing status.
+- Test credential validation result if approved.
+- Network path matrix.
+
+## Remediation
+
+- Deploy Windows LAPS.
+- Remove shared local admins.
+- Enforce SMB signing.
+- Enable Credential Guard where possible.
+- Restrict lateral admin protocols.
+- Monitor lateral logons and admin share access.
+

package/packaged-assets/.agents/skills/rt-scenario-n005/SKILL.md

@@ -0,0 +1,71 @@
+---
+name: rt-scenario-n005
+description: "N-005: Kerberos trust and ticket-lifetime persistence risk assessment. Domain: network. Authorized Active Directory scenario focused on KRBTGT hygiene, delegation, privileged accounts, detection, and remediation."
+---
+
+# N-005: Kerberos Privilege Persistence Risk
+
+## Overview
+
+This scenario evaluates whether Kerberos configuration and privileged account hygiene could allow long-lived domain persistence. It does not require creating forged tickets in production; most value comes from configuration review, rotation history, and detection readiness.
+
+| Field | Value |
+|---|---|
+| Domain | Active Directory |
+| Objective | Assess Kerberos persistence risk |
+| Required Access | Directory read access or admin-provided exports |
+| Detection Risk | Low for review, High for active validation |
+| Primary Impact | Long-lived privileged access |
+
+## Prerequisites
+
+- Domain scope approved.
+- Read-only review preferred.
+- KRBTGT rotation history available if possible.
+- SIEM/detection contacts identified.
+- No forged ticket activity unless explicitly approved in lab.
+
+## Risk Areas
+
+| Area | Why It Matters |
+|---|---|
+| KRBTGT Rotation | Stale KRBTGT secrets can extend persistence risk. |
+| Ticket Lifetime | Long lifetimes increase abuse window. |
+| Privileged Groups | Excess members increase credential exposure. |
+| Delegation | Misconfigured delegation can enable privilege paths. |
+| Logging | Weak Kerberos monitoring delays detection. |
+
+## Workflow
+
+1. Collect domain policy and Kerberos settings.
+2. Review KRBTGT rotation date and process.
+3. Review privileged group membership.
+4. Review delegation settings and service accounts.
+5. Review detection coverage for unusual tickets and privileged logons.
+6. Produce a rotation and monitoring roadmap.
+
+## MITRE ATT&CK Mapping
+
+| Phase | Tactic | Technique |
+|---|---|---|
+| Persistence | Persistence | Golden Ticket |
+| Credential Use | Defense Evasion | Use Alternate Authentication Material |
+| Privilege | Privilege Escalation | Valid Accounts |
+
+## Evidence
+
+- Domain policy export.
+- KRBTGT password last set date.
+- Privileged group review.
+- Delegation review.
+- Detection rule inventory.
+
+## Remediation
+
+- Rotate KRBTGT safely using a staged process.
+- Reduce ticket lifetimes where appropriate.
+- Clean privileged group membership.
+- Remove risky delegation.
+- Monitor anomalous TGT/TGS behavior.
+- Tier administrative accounts.
+