Skip to content
Get packs

AD ACL Abuse Analyzer

Scans Active Directory for risky permissions that could let attackers escalate privileges

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

When installed, the agent can connect to a Windows Active Directory domain controller over LDAP, read the permission lists (ACLs) attached to users, groups, computers and OUs, and flag non-admin accounts holding dangerous rights such as GenericAll, WriteDACL or WriteOwner. It explains the likely attack path for each finding and produces a JSON report with remediation steps. It is intended for defensive review of an environment the user is authorised to audit.

Great for

  • Security engineers auditing an Active Directory domain for privilege escalation paths
  • SOC analysts or students learning how BloodHound-style ACL attack paths are found
  • Blue teams checking whether helpdesk or service accounts have excessive permissions

Skip it if

  • Scanning domains you do not own or have written authorisation to test, since it reads sensitive directory data with domain credentials
  • Production environments without change control, because the script queries many objects and uses domain credentials that should be treated as sensitive

Try asking

  • “Check my corp.example.com domain for non-admin accounts with GenericAll or WriteDACL on Domain Admins”
  • “Scan the Finance OU for ACEs that let non-privileged users take ownership of objects and produce a JSON report”
  • “Explain which attack paths WriteOwner on a computer object would enable and how to remove it”
Step-by-step guide: how to use AD ACL Abuse AnalyzerInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    analyzing-active-directory-acl-abuse.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-active-directory-acl-abuse.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-active-directory-acl-abuse.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Use LDAPS (port 636) rather than plain LDAP so credentials and directory data are encrypted in transit
  • Scope the search to a specific OU first to limit the amount of sensitive data read and to speed up review
  • Review the included scripts/agent.py before running it, since it executes locally with your domain credentials

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.