# active-directory-attack-paths

Guides security assessments in Active Directory environments, covering privilege escalation paths from initial discovery to delegation and ACL abuse.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 319 installs
- Author: securityskills
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/securityskills/skills/tree/HEAD/pentest/active-directory/active-directory-attack-paths/SKILL.md
- Updated: 2026-08-26
- HTML: https://affpapa.org/en/nevibecode/skills/active-directory-attack-paths

## What it does

The skill gives your coding assistant a structured pentest workflow for corporate Windows domains. Stealth matters during collection. It guides the model through mapping trusts, auditing nested groups, and using BloodHound or SharpHound to spot accounts lacking preauthentication, roastable SPNs, and DCSync rights.

Instructions detail credential attacks like Kerberoasting and AS-REP roasting with hashcat modes 13100 and 18200. They address unconstrained delegation via SpoolSample and Rubeus, S4U2Proxy abuse, and RBCD through `msDS-AllowedToActOnBehalfOfOtherIdentity`. The steps also cover ACL tampering through `GenericAll` or `WriteDacl` and Certipy audits for AD CS templates.

Applying these techniques requires explicit permission. Running DCSync without clear approval crosses legal boundaries. The methodology mandates logging every command and removing temporary accounts or modified permissions when testing concludes.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill active-directory-attack-paths -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/active-directory-attack-paths/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/active-directory-attack-paths/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill active-directory-attack-paths -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/active-directory-attack-paths/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill active-directory-attack-paths -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/active-directory-attack-paths/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install securityskills/skills active-directory-attack-paths
```

2. **Manually: put the files in place**
- File: `.github/skills/active-directory-attack-paths/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill active-directory-attack-paths -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/securityskills/skills --path pentest/active-directory/active-directory-attack-paths
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/active-directory-attack-paths/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill active-directory-attack-paths -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/securityskills/skills/tree/HEAD/pentest/active-directory/active-directory-attack-paths/SKILL.md

## When to use it
- map domain privilege escalation paths using BloodHound
- extract and crack Kerberoasting hashes with hashcat
- exploit unconstrained and constrained Kerberos delegation
- abuse vulnerable Active Directory Certificate Services templates
- clean up temporary accounts and access rights after testing

## Example prompts
- Show the command to run SharpHound quietly while skipping domain controllers
- Generate the hashcat command for cracking tickets retrieved from Kerberoasting
- Explain the steps to abuse RBCD using msDS-AllowedToActOnBehalfOfOtherIdentity

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [securityskills/skills](https://affpapa.org/en/nevibecode/by/securityskills/skills.md) — 9 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md