Active Directory Attacks

21.8k

davila7

This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", "Silver Ticket", "AS-REP roasting", "NTLM relay", or needs guidance on Windows domain penetration testing.

Active Directory Attacks

3.5k

zebbern

This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", "Silver Ticket", "AS-REP roasting", "NTLM relay", or needs guidance on Windows domain penetration testing.

Network Analysis

43

openshift-eng

Analyze network configuration data from sosreport archives, extracting interface configurations, routing tables, active connections, firewall rules (firewalld/iptables), and DNS settings from the sosreport directory structure to diagnose network connectivity and configuration issues

Windows Infrastructure Admin

39

404kidwiz

Expert in Windows Server, Active Directory (AD DS), Hybrid Identity (Entra ID), and PowerShell automation.

ad-security-reviewer

39

404kidwiz

Use when user needs Active Directory security analysis, privileged group design review, authentication policy assessment, or delegation and attack surface evaluation across enterprise domains.

network-pentest

29

hardw00t

Internal network and Active Directory penetration testing skill for corporate environments. This skill should be used when performing internal network assessments, testing Active Directory security, exploiting Windows/Linux hosts, lateral movement, privilege escalation, and post-exploitation activities. Triggers on requests to pentest internal networks, attack Active Directory, perform lateral movement, or escalate privileges in Windows/Linux environments.

OSCP Cheat Sheet

14

zebbern

The assistant provides comprehensive OSCP exam preparation commands and techniques covering enumeration, exploitation, privilege escalation, and Active Directory attacks. Activate when users ask about "OSCP commands," "penetration testing cheat sheet," "privilege escalation techniques," "file transfer methods," or "Active Directory pentesting."

OSCP Penetration Testing Methodology

14

zebbern

This skill should be used when the user asks to "perform OSCP-style penetration testing", "enumerate network services", "escalate privileges on Windows or Linux", "conduct Active Directory attacks", "transfer files between systems", "crack password hashes", or "execute lateral movement techniques". It provides a comprehensive methodology and command reference for offensive security certification preparation and real-world penetration testing.

Active Directory Attacks

14

zebbern

This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", "Silver Ticket", "AS-REP roasting", "NTLM relay", or needs guidance on Windows domain penetration testing.

symfony-ldap

10

krzysztofsurdy

Connect to and interact with LDAP servers (OpenLDAP or Active Directory). Use this skill for LDAP authentication, user querying, entry management, and server integration.

symfony-ldap

10

krzysztofsurdy

Connect to and interact with LDAP servers (OpenLDAP or Active Directory). Use this skill for LDAP authentication, user querying, entry management, and server integration.

windows-server

10

BagelHole

Administer Windows Server systems. Manage IIS, Active Directory, and PowerShell automation. Use when administering Windows infrastructure.

Active Directory Attacks

5

agent-skills-hub

This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", "Silver Ticket", "AS-REP roasting", "NTLM relay", or needs guidance on Windows domain penetration testing.

attacking-active-directory

5

trilwu

Attack and enumerate Active Directory environments using Kerberos attacks (Kerberoasting, ASREPRoasting), credential dumping (DCSync, Mimikatz), lateral movement (PtH, PtT), and BloodHound analysis. Use when pentesting Windows domains or exploiting AD misconfigurations.

active-directory-attacks

4

ngxtm

This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", ...

pentest-active-directory

3

0x-Professor

Assess Active Directory identity attack paths including roasting, relay, and delegation abuse.

None

2

mukul975

Audit service accounts across enterprise infrastructure to identify orphaned, over-privileged, and non-compliant accounts. This skill covers discovery of service accounts in Active Directory, cloud pl

conducting-internal-reconnaissance-with-bloodhound-ce

2

mukul975

Conduct internal Active Directory reconnaissance using BloodHound Community Edition to map attack paths, identify privilege escalation chains, and discover misconfigurations in domain environments.

detecting-golden-ticket-attacks-in-kerberos-logs

2

mukul975

Detect Golden Ticket attacks in Active Directory by analyzing Kerberos TGT anomalies including mismatched encryption types, impossible ticket lifetimes, non-existent accounts, and forged PAC signatures in domain controller event logs.

exploiting-zerologon-vulnerability-cve-2020-1472

2

mukul975

Exploit the Zerologon vulnerability (CVE-2020-1472) in the Netlogon Remote Protocol to achieve domain controller compromise by resetting the machine account password to empty.

conducting-domain-persistence-with-dcsync

2

mukul975

Perform DCSync attacks to replicate Active Directory credentials and establish domain persistence by extracting KRBTGT, Domain Admin, and service account hashes for Golden Ticket creation.

exploiting-nopac-cve-2021-42278-42287

2

mukul975

Exploit the noPac vulnerability chain (CVE-2021-42278 sAMAccountName spoofing and CVE-2021-42287 KDC PAC confusion) to escalate from standard domain user to Domain Admin in Active Directory environments.

exploiting-kerberoasting-with-impacket

2

mukul975

Perform Kerberoasting attacks using Impacket's GetUserSPNs to extract and crack Kerberos TGS tickets for Active Directory service accounts.

exploiting-constrained-delegation-abuse

2

mukul975

Exploit Kerberos Constrained Delegation misconfigurations in Active Directory to impersonate privileged users via S4U2self and S4U2proxy extensions for lateral movement and privilege escalation.

recovering-from-ransomware-attack

2

mukul975

Executes structured recovery from a ransomware incident following NIST and CISA frameworks, including environment isolation, forensic evidence preservation, clean infrastructure rebuild, prioritized system restoration from verified backups, credential reset, and validation against re-infection. Covers Active Directory recovery, database restoration, and application stack rebuild in dependency order. Activates for requests involving ransomware recovery, post-encryption restoration, or disaster recovery from ransomware.

performing-active-directory-compromise-investigation

2

mukul975

Investigate Active Directory compromise by analyzing authentication logs, replication metadata, Group Policy changes, and Kerberos ticket anomalies to identify attacker persistence and lateral movement paths.

building-identity-federation-with-saml-azure-ad

2

mukul975

Establish SAML 2.0 identity federation between on-premises Active Directory and Azure AD (Microsoft Entra ID) for seamless cross-domain authentication and SSO to cloud applications.

None

2

mukul975

Implement Microsoft's Enhanced Security Admin Environment (ESAE) tiered administration model for Active Directory. Covers Tier 0/1/2 separation, privileged access workstations (PAWs), administrative f

exploiting-active-directory-with-bloodhound

2

mukul975

BloodHound is a graph-based Active Directory reconnaissance tool that uses graph theory to reveal hidden and unintended relationships within AD environments. Red teams use BloodHound to identify attac

exploiting-active-directory-certificate-services-esc1

2

mukul975

Exploit misconfigured Active Directory Certificate Services (AD CS) ESC1 vulnerability to request certificates as high-privileged users and escalate domain privileges during authorized red team assessments.

auditing-azure-active-directory-configuration

2

mukul975

Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, stale accounts, conditional access gaps, and guest user risks using AzureAD PowerShell, Microsoft Graph API, and ScoutSuite.

implementing-delinea-secret-server-for-pam

2

mukul975

Implements Delinea Secret Server for privileged access management (PAM) including secret vault configuration, role-based access policies, automated password rotation, session recording, and integration with Active Directory and cloud platforms. Activates for requests involving PAM deployment, privileged credential vaulting, secret server administration, or password rotation automation.

performing-service-account-credential-rotation

2

mukul975

Automate credential rotation for service accounts across Active Directory, cloud platforms, and application databases to eliminate stale secrets and reduce compromise risk.

performing-active-directory-vulnerability-assessment

2

mukul975

Assess Active Directory security posture using PingCastle, BloodHound, and Purple Knight to identify misconfigurations, privilege escalation paths, and attack vectors.

analyzing-windows-event-logs-in-splunk

2

mukul975

Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or perform forensic timeline analysis of Windows endpoints and domain controllers.

performing-kerberoasting-attack

2

mukul975

Kerberoasting is a post-exploitation technique that targets service accounts in Active Directory by requesting Kerberos TGS (Ticket Granting Service) tickets for accounts with Service Principal Names

executing-active-directory-attack-simulation

2

mukul975

Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege paths, and exploitable trust relationships that could lead to domain compromise. The tester uses BloodHound for attack path analysis, Mimikatz for credential extraction, and Impacket for protocol-level attacks including Kerberoasting, AS-REP Roasting, and delegation abuse. Activates for requests involving Active Directory pentest, AD attack simulation, domain compromise testing, or Kerberos attack assessment.

performing-active-directory-penetration-test

2

mukul975

Conduct a focused Active Directory penetration test to enumerate domain objects, discover attack paths with BloodHound, exploit Kerberos weaknesses, escalate privileges via ADCS/DCSync, and demonstrate domain compromise.

performing-active-directory-bloodhound-analysis

2

mukul975

Use BloodHound and SharpHound to enumerate Active Directory relationships and identify attack paths from compromised users to Domain Admin.

detecting-dcsync-attack-in-active-directory

2

mukul975

Detect DCSync attacks where adversaries abuse Active Directory replication privileges to extract password hashes by monitoring for non-domain-controller accounts requesting directory replication via DsGetNCChanges.

active-directory-attacks

1

rootcastleco

This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", ...

infra-pentesting

narlyseorg

Use when testing network infrastructure, servers, or internal/external networks. Triggers: host discovery, port scanning, service enumeration, vulnerability assessment, exploitation of network services, Active Directory attacks, password cracking, lateral movement, pivoting, privilege escalation, cloud infrastructure testing, network-level attacks like MITM or ARP spoofing. Covers TCP/UDP services including SSH, FTP, SMB, RDP, SNMP, DNS, LDAP, Kerberos, WinRM. Applies to both Linux and Windows targets in on-prem and cloud environments.

active-directory-attacks

reikiplanet

This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", ...

symfony-ldap

krzysztofsurdy

Connect to and interact with LDAP servers (OpenLDAP or Active Directory). Use this skill for LDAP authentication, user querying, entry management, and server integration.

Active Directory Attacks

oki3505F

This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", "Silver Ticket", "AS-REP roasting", "NTLM relay", or needs guidance on Windows domain penetration testing.

active-directory-attacks

aleister1102

This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", ...

Active Directory Attacks

haniakrim21

This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", "Silver Ticket", "AS-REP roasting", "NTLM relay", or needs guidance on Windows domain penetration testing.