Content
76%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A concise, highly actionable body with concrete commands and a clear attack workflow, weakened only by the absence of explicit validation/verification checkpoints for its destructive escalation chain.
Suggestions
Add explicit verification checkpoints in the escalation chain (e.g. confirm the relay succeeded and the certificate/TGT is valid before running secretsdump).
Consider splitting the per-vector protocol/RPC/mitigation table into a reference file to keep the core workflow leaner.
Add a feedback loop note for failed coercion (e.g. if no auth is captured, check protocol availability/patch level and retry with an alternative vector).
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Lean and efficient with no padding about what NTLM/AD is; commands and tables earn their tokens, with only minor explanatory phrasing ('All four boil down to...') that could be trimmed. | 4 / 5 |
Actionability | Provides copy-paste-ready commands with real flags (impacket-ntlmrelayx, Coercer.py, PetitPotam.py, certipy auth, secretsdump) covering relay, capture, ADCS, and DCSync cases. | 5 / 5 |
Workflow Clarity | A clear numbered sequence (listener -> coerce -> catch -> escalate) exists, but the operations are destructive/batch (domain compromise) and lack explicit validate-then-proceed checkpoints, which caps workflow clarity at 3 per the rubric. | 3 / 5 |
Progressive Disclosure | Well-organized single document with clear section headers and a vector table; no bundle files exist, and while ~95 lines could be split (per-vector deep-dives, OPSEC), it remains coherent and navigable. | 4 / 5 |
Total | 16 / 20 Passed |