active-directory-attack-paths — Claude Code skill: how to install
Guides security assessments in Active Directory environments, covering privilege escalation paths from initial discovery to delegation and ACL abuse.
npx skills add securityskills/skills --skill active-directory-attack-paths -a claude-codeWhat active-directory-attack-paths does
The skill gives your coding assistant a structured pentest workflow for corporate Windows domains. Stealth matters during collection. It guides the model through mapping trusts, auditing nested groups, and using BloodHound or SharpHound to spot accounts lacking preauthentication, roastable SPNs, and DCSync rights.
Instructions detail credential attacks like Kerberoasting and AS-REP roasting with hashcat modes 13100 and 18200. They address unconstrained delegation via SpoolSample and Rubeus, S4U2Proxy abuse, and RBCD through msDS-AllowedToActOnBehalfOfOtherIdentity. The steps also cover ACL tampering through GenericAll or WriteDacl and Certipy audits for AD CS templates.
Applying these techniques requires explicit permission. Running DCSync without clear approval crosses legal boundaries. The methodology mandates logging every command and removing temporary accounts or modified permissions when testing concludes.
What it helps with
- map domain privilege escalation paths using BloodHound
- extract and crack Kerberoasting hashes with hashcat
- exploit unconstrained and constrained Kerberos delegation
- abuse vulnerable Active Directory Certificate Services templates
- clean up temporary accounts and access rights after testing
Example prompts for the agent
- Show the command to run SharpHound quietly while skipping domain controllers
- Generate the hashcat command for cracking tickets retrieved from Kerberoasting
- Explain the steps to abuse RBCD using msDS-AllowedToActOnBehalfOfOtherIdentity
How to install active-directory-attack-paths
1Skills CLI (Vercel)
npx skills add securityskills/skills --skill active-directory-attack-paths -a claude-code2Manually: put the files in place
~/.claude/skills/active-directory-attack-paths/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/active-directory-attack-paths/
1Skills CLI (Vercel)
npx skills add securityskills/skills --skill active-directory-attack-paths -a codex2Manually: put the files in place
.agents/skills/active-directory-attack-paths/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add securityskills/skills --skill active-directory-attack-paths -a cursor2Manually: put the files in place
.cursor/skills/active-directory-attack-paths/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install securityskills/skills active-directory-attack-paths2Manually: put the files in place
.github/skills/active-directory-attack-paths/SKILL.md1Skills CLI (Vercel)
npx skills add securityskills/skills --skill active-directory-attack-paths -a gemini-cli2Platform CLI
gemini skills install https://github.com/securityskills/skills --path pentest/active-directory/active-directory-attack-pathsManually: put the files in place
.devin/skills/active-directory-attack-paths/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add securityskills/skills --skill active-directory-attack-paths -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about active-directory-attack-paths
How do I install active-directory-attack-paths in Claude Code?
Run npx skills add securityskills/skills --skill active-directory-attack-paths -a claude-code in your terminal.
What does active-directory-attack-paths do?
It instructs your agent on standard internal penetration testing techniques, guiding enumeration, credential extraction, and ACL escalation across Active Directory.
Which delegation attacks does the skill cover?
It outlines methods for unconstrained delegation with SpoolSample and Rubeus, constrained delegation using S4U2Proxy, and RBCD targeting msDS-AllowedToActOnBehalfOfOtherIdentity.
