Skip to content
Get packs

Offensive Lateral Movement

Guides an agent through authorized red-team lateral movement: credential reuse, NTLM relay, remote execution and pivoting

Source Download skill
Repository
SnailSploit/Claude-Red
Stars
10,230
Licence
MIT
Files
1 file

What it does

This skill gives an AI agent a detailed playbook for moving from one compromised computer to others inside a corporate network, the step penetration testers take after first gaining access. It covers reusing stolen password hashes and Kerberos tickets, relaying login attempts (NTLM relay with coercion tools like PetitPotam), running commands remotely over protocols such as WMI, WinRM and PsExec, and tunneling traffic through pivot hosts. It includes ready-to-run command sequences for tools like mimikatz, netexec, impacket and evil-winrm, plus OPSEC notes on avoiding detection and defender guidance on what logs these actions create.

Great for

  • Professional penetration testers working on authorized internal or assumed-breach engagements who want a quick reference for command syntax
  • Blue-team or detection engineers who want to understand which Windows events (such as 4768, 4769, 7045) these techniques produce

Skip it if

  • Anyone without written authorization to test the target network: the content is operator-ready attack tradecraft, and using it against systems you do not own or control is illegal
  • Beginners hoping to learn security basics: the skill assumes deep Active Directory knowledge and does not explain the underlying concepts
  • Production environments where an agent running these commands could cause lockouts, service disruption or unintended credential dumping

Try asking

  • “Given valid admin hash on this host, which hosts on 10.10.10.0/24 accept it, and show the exact netexec commands I should run for an authorized pentest”
  • “Explain how to set up ntlmrelayx against hosts without SMB signing for our assumed-breach exercise, with the OPSEC tradeoffs”
  • “Build a chisel or ligolo-ng pivot to reach the segmented database subnet from a compromised workstation, following our engagement scope”
  • “Summarize the Windows event IDs a defender should alert on for pass-the-hash and overpass-the-hash activity”
Step-by-step guide: how to use Offensive Lateral MovementInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the MIT licence and an attribution note.

    offensive-lateral-movement.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip offensive-lateral-movement.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip offensive-lateral-movement.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only use this skill with a signed scope document and explicit rules of engagement, and tell the agent the authorized target ranges so it stays in scope
  • Ask the agent to explain the detection footprint of each command so you can weigh noise against coverage before running anything
  • Review every generated command before execution, since the skill's instructions reference live credential dumping and relay tools that can affect production hosts

What's inside

  • SKILL.md

Redistributed unmodified from SnailSploit/Claude-Red under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.