Windows Active Directory Security
Guides an agent through authorized Active Directory attack-path testing, from enumeration to privilege escalation.
- Repository
- zhaoxuya520/reverse-skill
- Stars
- 43,969
- Licence
- MIT
- Files
- 2 files
What it does
This skill gives an AI agent a playbook for security testing of Windows Active Directory, the directory service that manages user accounts and access in many corporate networks. It tells the agent to start with an authorization scope check, then map identities and BloodHound attack paths before attempting exploitation, and to cover topics such as Kerberoasting, AD Certificate Services misconfigurations, NTLM relay, and delegation abuse. It also lists common tools (Impacket, NetExec, Certipy, BloodHound, Mimikatz and others) and asks the agent to log evidence and respect scope restrictions.
Great for
- Penetration testers working on an authorized Active Directory engagement who want a structured checklist
- Red team members reviewing AD attack paths and documenting their steps
- Security researchers studying Active Directory weaknesses in a lab
Skip it if
- Anyone testing a domain they do not have written permission to assess, since the skill drives credential theft and privilege escalation tools and could cause real harm or illegal access
- Production domain controllers without an agreed scope, because some listed actions (such as DCSync or golden tickets) can disrupt live systems
- Beginners with no security background, because the skill assumes familiarity with Kerberos, NTLM and AD concepts and the tools it names
Try asking
- “Map the attack paths from a compromised user account in our authorized lab domain using BloodHound”
- “Check our AD CS certificate templates for ESC1-style misconfigurations in the test environment”
- “Outline a Kerberoasting test plan for the scope we agreed in the engagement letter”
- “Help me write up evidence and reproducible commands from our NTLM relay test, with sensitive values redacted”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 2 original files, the MIT licence and an attribution note.
windows-ad.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip windows-ad.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip windows-ad.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Define the scope first: list the domain, domain controllers, and whether poisoning or relay is allowed, before any enumeration
- Begin with identity enumeration and BloodHound graphs rather than exploitation, as the skill itself recommends
- Keep the agent's logs and command records, and redact credentials before sharing reports
What's inside
- references/ad-attack-paths.md
- SKILL.md
Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.