competition-identity-windows

1# Competition Identity Windows
2 
3Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4 
5Use this skill when the challenge revolves around identity flow, replayable credentials, Windows host artifacts, enterprise mail, or lateral movement.
6 
7Reply in Simplified Chinese unless the user explicitly requests English.
8 
9## Quick Start
10 
111. Map the identity or pivot chain before diving into every host artifact.
122. Separate credential possession from accepted privilege.
133. Correlate identity evidence, host evidence, and mail evidence on one timeline.
144. Keep tickets, SIDs, event IDs, mailbox rules, and pivot hosts in compact evidence blocks.
155. Reproduce the privilege edge or mail effect from the smallest viable chain.
16 
17## Workflow
18 
19### 1. Identity And AD
20 
21- Trace principal origin, sync path, token or ticket minting, claims transformation, group resolution, and accepting service.
22- When Kerberos matters, record ticket type, SPN, delegation mode, PAC or group data, encryption type, and cache location.
23 
24### 2. Windows Host And Pivoting
25 
26- Correlate SAM, SECURITY, SYSTEM, NTDS, DPAPI, LSA secrets, ETW, Sysmon, PowerShell, services, tasks, WMI, WinRM, SMB, and RDP as one pivot graph.
27…