How to use the Active Directory Attack-Path Assessment agent skill

What an agent skill is and what this one makes the agent do

An agent skill is a folder with a SKILL.md file that gives an AI agent specific instructions for one kind of task. The agent loads the skill when your request matches its description.

This skill starts from configuration evidence you supply. It maps which principals (users, groups, accounts) have permissions on which resources, and lists the preconditions each technique would need. It treats each possible path as a hypothesis until the evidence confirms it, and it writes a report with mitigations.

• Maps candidate principal → permission → resource → possible action paths
• Lists the preconditions for a specific technique, separating credential disclosure, authentication, execution and privileged state change
• Checks areas such as Kerberos time settings, account exposure, replication rights, ticket abuse, relay protections, AD CS templates and known CVE prerequisites
• Writes a report using a fixed template covering scope, evidence, limits and remediation

Install the skill from the ZIP download

Download the ZIP for this skill from this page. Then install it in one of two ways. For a personal setup, unzip it into ~/.claude/skills/. To limit it to one project, unzip it into that project's .claude/skills/ folder.

In the Claude apps you can instead upload the ZIP under Settings → Capabilities → Skills.

• Personal: unzip into ~/.claude/skills/
• Single project: unzip into the project's .claude/skills/ folder
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

Check the package contents

The skill ships with two files. SKILL.md holds the workflow, the confirmation gate and the reporting template. references/advanced-attacks.md is a review checklist for delegation and other trust-boundary topics that SKILL.md links to.

• SKILL.md
• references/advanced-attacks.md

Trigger the skill with natural requests

You do not need a special command. Describe the authorized review in plain language and include the scope and the evidence you have. The skill asks for missing details before anything active happens.

Good requests name the domain, the evidence you are providing and the outcome you want, for example a report of possible paths and mitigations.

• "I have written permission to review the corp.example domain. Here is the group membership export. Map who can reach the domain admin group and suggest mitigations."
• "Review this delegation configuration export for unconstrained and constrained delegation risks. Do not run anything against the domain."
• "Help me design a synthetic Active Directory training lab to demonstrate AD CS template misconfigurations."

Understand the confirmation gate

Before any command that probes, authenticates, changes, extracts data or touches credentials, the skill stops and asks for the exact target, written authorization and permitted scope. It then shows the exact command and its expected effect and waits for your explicit confirmation in the same conversation.

Without that confirmation the agent stays read-only and gives defensive guidance. Having credentials or a tool installed does not count as authorization.

• Target: exact domain, controllers, hosts or accounts
• Authorization: confirm written owner permission and permitted techniques
• Limits: timing and lockout or request limits
• Confirmation: explicit go-ahead before execution

Safety notes on scripts and network use

This skill runs no scripts and makes no network connections itself. It only provides instructions and a checklist. Any tool you choose to run in a real review is your own action and falls under the gate above.

The skill advises against default password sprays, DCSync or krbtgt extraction, credential dumps, remote shells, machine-password resets and persistence. It also warns that BloodHound collection can contact many hosts and expose sensitive topology, so agree on a collector version and scope instead of running broad collection by default.

Keep production secrets and privileged identities out of exercises. Use synthetic users, service accounts and canary resources in a disposable owner lab.

• Runs no scripts and uses no network by itself
• Avoid running broad collection like BloodHound All by default
• Do not reset domain-controller passwords or change the host clock to make a demo work
• Stop if you see unexpected real data or cross-domain scope

Tips for getting useful results

Supply evidence before asking for conclusions. Exports of group memberships, ACLs, delegation settings and certificate template configuration give the agent something concrete to check. Say what is missing and the skill will record it as a gap instead of guessing.

Expect the agent to avoid confident claims. An attack-graph edge is a hypothesis, and an empty tool result does not prove a control is absent. Older tool names or flags in other playbooks may be outdated, and the skill tells the agent not to infer current flags from its own text.

• Provide exports and configuration evidence, not live credentials
• Ask for the report template when you want a shareable write-up
• Ask for a control case when you plan a lab test, so results can be compared