Active Directory attack lane — BloodHound ingestion, Kerberoasting, ADCS ESC scanning, DCSync, LAPS extraction.
| Skill | Use for |
|---|---|
/skills/ad/bloodhound-query/SKILL.md | Ingest + common Cypher queries |
/skills/ad/kerberoasting/SKILL.md | Roast SPN users, crack with hashcat |
/skills/ad/asrep-roasting/SKILL.md | dontreqpreauth users |
/skills/ad/adcs-esc1/SKILL.md | ESC1 template abuse → domain admin |
/skills/ad/dcsync/SKILL.md | Replication rights → krbtgt dump |
/skills/ad/laps/SKILL.md | LAPS local admin password extraction |
bash("bloodhound-python -u user -p pass -d DOMAIN -c all --zip")bh_ingest_zip("/workspace/bh.zip")dcsync_check — if any principal, that's instant domain compromisekg_query(kind="user") and filter for hasspn=true → Kerberoast queuekg_query(kind="user") and filter for dontreqpreauth=true → AS-REP roastbash("certipy find -u user -p pass -dc-ip X -json") then adcs_auditplan_attack_chains to see graph-computed domain compromise pathskg_add_node(kind="crown_jewel", label="Domain Admins group")
kg_add_node(kind="crown_jewel", label="krbtgt account")
kg_add_node(kind="crown_jewel", label="DC: DC01.corp.local")