active-directory-acl-abuse

1# SKILL: AD ACL Abuse — Expert Attack Playbook
2 
3> **AI LOAD INSTRUCTION**: Expert AD ACL abuse techniques. Covers BloodHound enumeration, dangerous ACEs (GenericAll, WriteDACL, WriteOwner, etc.), DCSync, shadow credentials, targeted kerberoasting, group manipulation, LAPS, and GPO abuse. Base models miss complex ACL chain exploitation and Cypher query patterns.
4 
5## 0. RELATED ROUTING
6 
7Before going deep, consider loading:
8 
9- [active-directory-kerberos-attacks](../active-directory-kerberos-attacks/SKILL.md) for Kerberos attacks often chained with ACL abuse
10- [active-directory-certificate-services](../active-directory-certificate-services/SKILL.md) for certificate-based attacks after ACL exploitation
11- [ntlm-relay-coercion](../ntlm-relay-coercion/SKILL.md) for relay attacks that can set ACLs (LDAP relay)
12- [windows-lateral-movement](../windows-lateral-movement/SKILL.md) after gaining elevated AD access
13 
14### Advanced Reference
15 
16Also load [BLOODHOUND_PATHS.md](./BLOODHOUND_PATHS.md) when you need:
17- Common BloodHound attack paths with Cypher queries
18- Custom Neo4j queries for finding complex chains
19- Data collection and ingestion tips
20 
21---
22 
23## 1. BLOODHOUND ENUMERATION
24 
25### Data Collection
26 
27```bash
28# SharpHound (from Windows, domain-joined)
29SharpHound.exe -c all --outputdirectory C:\temp --zipfilename bh.zip
30 
31# bloodhound-python (from Linux)
32bloodhound-python -d domain.com -u user -p password -c all -dc DC01.domain.com -ns DC_IP
33 
34# Specific collection methods
35…