Skip to content
Get packs

BloodHound CE Active Directory Recon

Maps attack paths from a low-privileged Active Directory account to Domain Admin using BloodHound CE

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
7 files

What it does

When installed, the agent knows how to run an internal Active Directory reconnaissance workflow with BloodHound Community Edition. It walks through deploying the BloodHound server, collecting AD data with SharpHound or BloodHound.py, importing it, running built-in and custom Cypher queries, and ranking the discovered attack paths by hop count, stealth and detection risk. It also includes helper scripts that call the BloodHound ingestor and query a Neo4j database, and a script that summarises exported JSON into reports such as Kerberoastable and DCSync-capable accounts.

Great for

  • Red team operators running an authorized engagement who already have a foothold in a test domain
  • Blue teams validating that known AD attack paths to Domain Admin have been closed
  • Security students learning how BloodHound graph analysis exposes privilege escalation chains in a lab

Skip it if

  • Any network or domain you do not own or lack written permission to test, since the skill is built for offensive reconnaissance and this is illegal without consent
  • Production domains without a change window and sign-off, because collection and session enumeration generate significant LDAP and authentication traffic that can be detected or disrupt services
  • Non-security users looking for general Active Directory administration help, as the content is oriented toward attacking rather than managing AD

Try asking

  • “Set up BloodHound CE with Docker Compose and collect All data from our authorized lab domain using SharpHound”
  • “Show me the shortest paths from my owned user accounts to Domain Admins in the imported BloodHound data”
  • “Find Kerberoastable users and DCSync-capable accounts in this JSON export and summarise them”
  • “Score the attack paths I found by hop count and detection risk and draft an execution plan for the top three”
Step-by-step guide: how to use BloodHound CE Active Directory ReconInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.

    conducting-internal-reconnaissance-with-bloodhound-ce.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip conducting-internal-reconnaissance-with-bloodhound-ce.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip conducting-internal-reconnaissance-with-bloodhound-ce.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run only inside an isolated lab or a scoped engagement with written authorization, and record that authorization in the report
  • Review scripts/agent.py before running: it passes domain credentials on the command line and runs bloodhound-python as a subprocess, so credentials may appear in process listings
  • Change the default BloodHound admin password immediately after deployment, as the workflow itself recommends, and keep the server off public networks

What's inside

  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.