Skip to content
Get packs

DCSync Domain Persistence

Guides an agent through DCSync credential theft and Golden Ticket persistence in Active Directory, for authorized red teams.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
7 files

What it does

This skill gives an AI agent a step-by-step playbook for DCSync, an attack that pretends to be a domain controller to ask Active Directory for password hashes, including the KRBTGT account hash. With that hash, the attacker can forge Golden Tickets for long-term access. The skill lists commands for Mimikatz and Impacket, explains how to grant replication rights to a backdoor account, and includes Python scripts that audit which accounts hold replication rights and parse dumped hash files. It is written for offensive security testing and detection validation, not for defenders building basic protections.

Great for

  • Authorized penetration testers and red teams who need a structured DCSync and Golden Ticket checklist in a lab or contracted engagement
  • Blue teams validating detections for replication abuse (MS-DRSR, DS-Replication rights)
  • Students learning how Active Directory replication privileges can be abused

Skip it if

  • Anyone without written authorization: the steps dump real domain credentials and create persistent backdoors, which is illegal against systems you do not own or have permission to test
  • Beginners looking for general Active Directory hardening; the skill focuses on attack execution rather than defence
  • Production environments without a rollback plan: granting replication rights or forging tickets can leave lasting changes to the domain

Try asking

  • “Audit my lab domain for accounts that hold DS-Replication-Get-Changes-All rights and list them”
  • “Walk me through validating a detection for DCSync replication abuse in our test forest”
  • “Parse this secretsdump.py output file and summarise the NTLM hashes and KRBTGT entry”
  • “Document the attack chain and persistence mechanisms for our authorized red team report”
Step-by-step guide: how to use DCSync Domain PersistenceInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.

    conducting-domain-persistence-with-dcsync.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip conducting-domain-persistence-with-dcsync.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip conducting-domain-persistence-with-dcsync.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only run against a lab or a domain covered by a signed scope document, and keep the agent in a confirm-before-execute mode for any command that touches a domain controller
  • Prefer the audit and parsing scripts for detection work; treat credential dumping and ticket forging commands as high-risk actions to review manually
  • Ask the agent to log every command and target so the report can show exactly what changed and how to revert it, such as removing any added ACL entries

What's inside

  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.