Add Windows Offensive TTPs (6 new techniques)

[godlovepenn]

Summary:
Adds a comprehensive suite of Windows-focused offensive TTPs covering credential access, defense evasion, discovery, execution, and persistence techniques. These TTPs simulate common adversary behaviors for purple team exercises and detection validation.

TTP Overview:

Chrome Credential Extraction (Credential Access):

• Extracts Chrome saved passwords, tokens, and cookies on Windows
• Decrypts master key via Windows DPAPI (CryptUnprotectData)
• Uses AES-GCM to decrypt individual credential entries

BYOVD Driver Load (Defense Evasion):

• Simulates Bring Your Own Vulnerable Driver attacks
• Loads vulnerable signed drivers to disable security controls

WMI System Discovery (Discovery):

• Performs system reconnaissance using Windows Management Instrumentation
• Gathers system information, installed software, and running processes

HTML Smuggling (Execution):

• Delivers payloads via HTML/JavaScript blob construction
• Bypasses web proxies and content filters

Shellcode Injection (Execution):

• Demonstrates process injection techniques on Windows
• Uses native Windows API calls for memory allocation and execution

Scheduled Task COM (Persistence):

• Creates persistence via COM-based scheduled task manipulation
• Avoids schtasks.exe command-line detection

MITRE ATT&CK Coverage:

• T1555.003: Credentials from Web Browsers
• T1211: Exploitation for Defense Evasion
• T1082: System Information Discovery
• T1027.006: HTML Smuggling
• T1055: Process Injection
• T1053.005: Scheduled Task/Job

Reviewed By: d0n601

Differential Revision: D92549862

[meta-codesync]

@godlovepenn has exported this pull request. If you are a Meta employee, you can view the originating Diff in D92549862.

[meta-codesync]

This pull request has been merged in aabbd8f.