ad-attacks

Use when attacking Active Directory environments, hunting Kerberoastable accounts, AS-REP roasting, DCSync, Pass-the-Hash, Pass-the-Ticket, BloodHound path…

Skill by kalpmodi

IndexedMIT★ 23

Write a review

Install

Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install skill/kalpmodi-ad-attacks

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

Use when attacking Active Directory environments, hunting Kerberoastable accounts, AS-REP roasting, DCSync, Pass-the-Hash, Pass-the-Ticket, BloodHound path analysis, LDAP enumeration, GPO abuse, ACL abuse, or full AD domain compromise chains. Also use when the user says "attack AD", "domain compromise", "Kerberoast", "DCSync", "BloodHound", or "lateral movement".

Use cases: marketing

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.

Tools: No tools found
Secrets: None asked for
Install scripts: None found

Network hosts it talks to 1

codeload.github.com · found in install command

Files it touches

~/.claude/skills/ad-attacks

What's inside

Skill name: ad-attacks
Description: Use when attacking Active Directory environments, hunting Kerberoastable accounts, AS-REP roasting, DCSync, Pass-the-Hash, Pass-the-Ticket, BloodHound path analysis, LDAP enumeration, GPO abuse, ACL abuse, or full AD domain compromise chains. Also use when the user says "attack AD", "domain compromise", "Kerberoast", "DCSync", "BloodHound", or "lateral movement".
License: MIT
Instructions: 27 lines in SKILL.md · view on GitHub

Files (1)

SKILL.md

SKILL.md (first lines)

# Active Directory Attacks - Redirect Stub

AD attack TTPs have been consolidated into the **redteam** skill, which is the canonical source for all AD, post-exploitation, lateral movement, and APT simulation techniques.

**Immediately invoke:**

```
/redteam <target> --focus=ad
```

The `--focus=ad` flag tells redteam to prioritize:
1. BloodHound collection and shortest-path analysis
2. Kerberoasting + AS-REP roasting
3. LDAP enumeration (null session -> authenticated)
4. Pass-the-Hash / Pass-the-Ticket chains
5. ADCS ESC1-ESC8 certificate abuse
6. Constrained/unconstrained delegation + RBCD
7. DCSync + DCShadow
8. GPO abuse + ACL abuse (T1484 / T1222)
9. Golden/Silver ticket forge
10. Domain compromise - NTDS.dit extraction

All techniques are documented in `~/.claude/skills/redteam/SKILL.md` under Classes RT04, RT05, RT05b, RT05c.

For full APT kill chain (C2, LotL, AMSI bypass, persistence, defense evasion, cloud APT, exfil, OPSEC) run `/redteam <target>` without the focus flag after obtaining a foothold.

From kalpmodi/akira, MIT.

Signals

Stars: 23
Forks: 4
Open issues: 0
Last commit (this folder): Apr 25, 2026 (6 months ago)
Last release: Apr 25, 2026 (6 months ago)

From GitHub (fetched Oct 24, 2026).

Details

License: MIT
Repository: github.com/kalpmodi/akira
First seen: Oct 24, 2026
Last checked: Oct 24, 2026
Source: GitHub github-graphql

More from kalpmodi

Cite this page

ad-attacks skill. Agent Mart. https://agentmart.dev/skills/kalpmodi-ad-attacks (last updated 2026-10-24)