Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1556.005_reversible-encryption
An adversary may abuse Active Directory authentication encryption properties to gain access to credentials on Windows systems.
Passed 20 of 22 test cases with the skill, and 14 of 22 without it.
and 9 more in the full report
6 fixed14 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
When attempting to recover passwords encrypted via reversible password encryption in Active Directory, an analyst claims having the user's `userParameters` attribute and the domain NTDS.dit file is sufficient. What critical system-wide secret stored in the local registry/LSA is missing from that collection?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies G$MSRADIUSCHAPKEY as the global LSA secret required for decryption. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1556
An adversary may abuse Active Directory authentication encryption properties to gain access to credentials on Windows systems. The AllowReversiblePasswordEncryption property specifies whether reversible password encryption for an account is enabled or disabled. By default this property is disabled (instead storing user credentials as the output of one-way hashing functions) and should not be enabled unless legacy or other software require it.
If the property is enabled and/or a user changes their password after it is enabled, an adversary may be able to obtain the plaintext of passwords created/changed after the property was enabled. To decrypt the passwords, an adversary needs four components:
With this information, an adversary may be able to reproduce the encryption key and subsequently decrypt the encrypted password value.
An adversary may set this property at various scopes through Local Group Policy Editor, user properties, Fine-Grained Password Policy (FGPP), or via the ActiveDirectory PowerShell module. For example, an adversary may implement and apply a FGPP to users or groups if the Domain Functional Level is set to "Windows Server 2008" or higher. In PowerShell, an adversary may make associated changes to user settings using commands similar to Set-ADUser -AllowReversiblePasswordEncryption $true.
Platforms: Windows
test cases passed, vs 14 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.