How to use the DCSync Domain Persistence agent skill

What the skill makes the agent do

DCSync abuses the Microsoft Directory Replication Service Remote Protocol (MS-DRSR) to impersonate a Domain Controller and request password data from the target DC. Any principal with the DS-Replication-Get-Changes and DS-Replication-Get-Changes-All rights can replicate hashes for accounts in the domain, including KRBTGT. The skill tells the agent how to perform this in four phases: identify accounts with replication rights, extract credentials, create Golden Tickets, and set up persistence by granting DCSync rights to a controlled account.

• Enumerate principals with replication rights using PowerView, a BloodHound Cypher query, or Impacket's findDelegation.py
• Extract hashes with Mimikatz (Windows) or Impacket's secretsdump.py (Linux)
• Create Golden Tickets with Mimikatz or Impacket's ticketer.py
• Grant DCSync rights to a backdoor account using PowerView or ntlmrelayx.py
• Document results with a report template covering extracted credentials, persistence mechanisms and remediation

How to install the skill

Download the skill ZIP from this page and unzip it. To use it with Claude Code for all your projects, unzip it into ~/.claude/skills/. To limit it to one project, unzip it into that project's .claude/skills/ folder.

To use it in the Claude apps instead, open Settings, go to Capabilities, and upload the skill under Skills.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project folder
• Claude apps: Settings → Capabilities → Skills

How to trigger the skill with natural requests

You do not need to type the skill name. The skill is meant to be used in authorized engagements after you have found principals with replication rights, when you want to establish long-term domain persistence, or when you need to validate detections for replication abuse. Say what you are trying to do, and state that the work is authorized and in a lab or contracted scope.

Requests that match the skill's purpose include the following. Adjust the wording to your engagement.

• In our authorized lab, list which accounts have DS-Replication-Get-Changes-All rights on the domain.
• We have written approval for this test. Walk me through a DCSync extraction of the krbtgt hash and the Golden Ticket steps.
• Help me build a checklist to validate our detections for DRSUAPI replication traffic from non-DC hosts.
• Parse this dumped hash file and summarise the accounts and hash types it contains.

Example: the phases the agent follows

The skill's workflow starts with enumeration. The agent runs PowerView's Get-DomainObjectAcl filtered to replication rights, or a BloodHound query, and checks the default groups that hold DCSync rights: Domain Admins, Enterprise Admins, the Domain Controllers group and SYSTEM on Domain Controllers.

The skill also includes a detection section. It lists Event 4662 with the replication GUIDs, Event 5136 for directory service object changes, DRSUAPI traffic from unusual IPs, and ACL changes on the domain root. Blue teams can use these to test whether their monitoring catches replication abuse.

What you need before running it

The skill lists its requirements in its source. You need Python 3.8 or later and the ldap3 library, installed with pip install ldap3. Impacket tools such as secretsdump.py, ticketer.py, findDelegation.py and ntlmrelayx.py are used. On Windows, Mimikatz and PowerView are needed. BloodHound is used for relationship queries. You also need domain credentials, or a compromised account with replication rights for the target domain.

The package includes scripts/agent.py and scripts/process.py. The source describes these as Python scripts that audit which accounts hold replication rights and parse dumped hash files. Review them before running.

• Python 3.8+
• ldap3 (pip install ldap3)
• Impacket tools: secretsdump.py, ticketer.py, findDelegation.py, ntlmrelayx.py
• Mimikatz and PowerView (Windows)
• BloodHound
• Domain credentials or a compromised account with replication rights

Safety notes: scripts and network access

This skill runs scripts and uses the network. The steps dump real domain credentials, forge tickets and can create persistent backdoors. Granting replication rights or forging tickets can leave lasting changes to the domain. Use it only against systems you own or have written permission to test, and only in a lab or contracted engagement with a rollback plan.

The source's remediation guidance includes a double KRBTGT password reset with a 10-hour gap, auditing accounts with replication rights, enabling Event 4662 logging for replication GUIDs, and deploying DRSUAPI traffic monitoring.

• Get written authorization before any test
• Run only in a lab or contracted scope with a rollback plan
• Review scripts/agent.py and scripts/process.py before execution
• Record every credential extracted and every rights change made
• Clean up backdoor accounts and ACL changes after the engagement

Tips for getting better results

Start with enumeration before any extraction. Knowing exactly which accounts hold replication rights tells you what is possible and what to report. Give the agent your domain name, DC address and the account you are testing from, so it uses the right commands.

Use the included report template to organise findings. It has tables for the domain, extracted credentials, persistence mechanisms and remediation actions.

• Name the domain and DC in your request so commands are filled in correctly
• Ask for detection checks alongside each attack step to validate your monitoring
• Use the template in assets/template.md to record results