SKILL.md

offensive-active-directory

Active Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalation (ACL abuse, GPO abuse, unconstrained/constrained delegation), lateral movement (Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, WMI/WinRM/PsExec), persistence (Golden/Silver/Diamond Tickets, DCSync, DCShadow, AdminSDHolder, Skeleton Key), forest trust attacks, ADCS abuse (ESC1-ESC15), and modern MDI/Defender for Identity evasion. Use when assessing on-prem AD, hybrid AD/Entra ID environments, or ADCS deployments.

install offensive-active-directory

# install the Claude-Red pack with the skills CLI

npx skills add SnailSploit/Claude-Red

# or add only this skill to Claude Code: copy the folder

Skills/active-directory/offensive-active-directory/

# into

~/.claude/skills/offensive-active-directory/ (all projects)

.claude/skills/offensive-active-directory/ (one project)

Skills/active-directory/offensive-active-directory/SKILL.md

MITFull file

1# Active Directory — Offensive Testing Methodology
2 
3## Quick Workflow
4 
51. Recon AD structure offline (BloodHound, ADExplorer snapshot) — minimize live queries
62. Harvest creds via poisoning, Kerberoasting, ASREProast, or LSASS where allowed
73. Map attack paths to Domain Admin / Enterprise Admin / Tier 0
84. Execute path with lowest detection cost, validate at each hop
95. Establish persistence and document every action with timestamps
10 
11---
12 
13## Reconnaissance
14 
15### BloodHound Collection
16 
17```powershell
18# SharpHound (CSharp collector) — most stealthy with throttling
19SharpHound.exe -c All,GPOLocalGroup --Throttle 1000 --Jitter 30 --ZipFileName recon.zip
20 
21# Stealth collection (DC-only, avoids workstation noise)
22SharpHound.exe -c DCOnly --Stealth
23 
24# Bloodhound.py from Linux (no Windows host needed)
25bloodhound-python -d corp.local -u user -p pass -ns 10.0.0.1 -c All
26```
27 
28### PowerView (No Tool Drop)
29 
30```powershell
31# Domain enumeration without binaries
32$d = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
33Get-DomainUser -SPN | Select samaccountname,serviceprincipalname
34Get-DomainComputer -Unconstrained
35Get-DomainGPO | ?{$_.gpcmachineextensionnames -match "Restricted Groups"}
36Get-DomainObjectAcl -Identity 'Domain Admins' -ResolveGUIDs |
37  ?{$_.ActiveDirectoryRights -match 'WriteDacl|GenericAll|WriteOwner'}
38```
39 
40### ADExplorer Offline
41 
42```
43# Take snapshot from any low-priv user, analyze offline
44ADExplorer.exe → File → Create Snapshot
45# Convert to BloodHound format
46…

Excerpt shown under the repository's MIT license.

How to install offensive-active-directory

Skills/active-directory/offensive-active-directory/SKILL.md

More skills in Claude-Red

Newsletter

Join the Community