Content
87%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body is a concise, highly actionable ADCS-abuse runbook with clean sectioning and executable commands throughout. Its one weakness is the absence of explicit validation/verification checkpoints between the destructive chain steps.
Suggestions
Insert validation checkpoints between chain steps — e.g., after 'certipy req' confirm the .pfx was written, after 'certipy auth' confirm the TGT/NT hash was obtained before proceeding to DCSync.
Add a brief 'Verify compromise' step (e.g., confirm DA membership / krbtgt hash is valid) as the terminal checkpoint of the main chain.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Lean runbook of commands and terse notes with no padding explaining ADCS/PKI fundamentals Claude already knows; every section earns its tokens. | 3 / 3 |
Actionability | Provides concrete, executable certipy/impacket commands with real flags and placeholders (e.g., '-upn administrator@target.local', '--adcs --template DomainController'), copy-paste ready. | 3 / 3 |
Workflow Clarity | The 5-step chain is clearly numbered and sequenced, but high-stakes destructive operations (cert request as DA, DCSync) lack explicit validation checkpoints between steps, which caps this at 2 per the rubric. | 2 / 3 |
Progressive Disclosure | Self-contained single-file runbook (~120 lines) with no bundle files present and well-organized sections (find, catalog, exploit, auth, DCSync, OPSEC, references); a clear, self-sufficient overview. | 3 / 3 |
Total | 11 / 12 Passed |