Skip to content
Get packs

Coercing Authentication with Coercer

Force a Windows machine account to authenticate to a listener, for authorized relay testing

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
4 files

What it does

This skill teaches an AI agent how to run penetration-testing steps that make a Windows server, often a Domain Controller, send its machine-account login to a listener the tester controls. The agent is guided through Coercer and PetitPotam scans and coercion, then through an NTLM relay chain into AD CS (ESC8), LDAP (RBCD), or SMB. It is aimed at authorized red-team engagements and detection validation, and it includes a legal notice requiring written permission.

Great for

  • Security professionals running authorized Active Directory red-team engagements
  • Blue teams validating that coercion detections and signing/EPA mitigations work

Skip it if

  • Anyone testing systems without explicit written authorization, since the chain can yield full domain compromise and is illegal to run without permission
  • Non-security users, because the workflow requires Active Directory, relay tooling and attack-host skills

Try asking

  • “Scan our test domain controller 10.0.0.10 for coercible RPC methods with Coercer”
  • “Walk me through an authorized ESC8 relay test against our AD CS web enrollment server”
  • “Validate that our DCs block PetitPotam coercion after patching”
Step-by-step guide: how to use Coercing Authentication with CoercerInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 4 original files, the Apache-2.0 licence and an attribution note.

    coercing-authentication-with-coercer-petitpotam.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip coercing-authentication-with-coercer-petitpotam.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip coercing-authentication-with-coercer-petitpotam.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only use with written scope that explicitly includes coercion and NTLM relay, and keep a log of every command run
  • Start with the scan mode to see which methods are reachable before attempting any coerce action
  • Confirm the target lab's signing and EPA settings and remove the test artifacts (certificates, delegation changes) afterwards

What's inside

  • references/api-reference.md
  • references/standards.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.