offensive-active-directory

Active Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalation (ACL abuse, GPO abuse, unconstrained/constrained delegation), lateral movement (Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, WMI/WinRM/PsExec), persistence (Golden/Silver/Diamond Tickets, DCSync, DCShadow, AdminSDHolder, Skeleton Key), forest trust attacks, ADCS abuse (ESC1-ESC15), and modern MDI/Defender for Identity evasion. Use when assessing on-prem AD, hybrid AD/Entra ID environments, or ADCS deployments.

Quality

84%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

76%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An exceptionally actionable, lean offensive-AD reference packed with executable commands and well-structured sections. Its main weakness is workflow validation: destructive and batch operations lack explicit verify→remediate→retry feedback loops.

Suggestions

Add explicit validation/verification feedback loops for destructive techniques — e.g., after DCShadow /push or GPO abuse, show how to confirm the change took effect and how to roll back on failure before proceeding.

Reconcile the 'Engagement Cheatsheet' with the detailed sections to remove duplicated commands, or explicitly frame it as a quick-reference index that links back to the detailed sections.

Consider moving the large ADCS (ESC1-ESC15) and Persistence catalogs into separate reference files with one-line pointers from SKILL.md to reduce the monolithic single-file footprint.

Dimension	Reasoning	Score
Conciseness	Dense and largely token-efficient with no concept over-explanation, but the closing 'Engagement Cheatsheet' repeats commands already shown in earlier sections, a minor redundancy that could be trimmed.	4 / 5
Actionability	Throughout, the skill provides fully executable, copy-paste-ready commands with specific tools (Rubeus, certipy, impacket, BloodHound), exact flags, and hashcat modes covering the common cases.	5 / 5
Workflow Clarity	The Quick Workflow gives a clear 5-step sequence and mentions 'validate at each hop', but destructive techniques (DCShadow push, GPO abuse, Golden Ticket, password resets) lack explicit validate→fix→retry feedback loops, capping this dimension per the destructive-ops rule.	3 / 5
Progressive Disclosure	Well-organized with clear section headers (Reconnaissance, Credential Harvesting, ADCS, Persistence) and an explicit Key References block; no bundle files exist so there is no nested-reference problem, though the large single-file reference could optionally split detailed technique catalogs into separate files.	4 / 5
	Total	16 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, well-scoped description that explicitly covers what the skill does and when to use it with concrete trigger phrases and domain keywords. Minor room only in capturing a few additional colloquial trigger terms.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions across recon, credential abuse, privesc, lateral movement, persistence, ADCS, and evasion with specific technique names (Kerberoasting, DCSync, ESC1-ESC15), giving comprehensive coverage rather than vague language.	5 / 5
Completeness	Explicitly answers both 'what' (the enumerated attack methodology categories) and 'when' ('Use when assessing on-prem AD, hybrid AD/Entra ID environments, or ADCS deployments') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Strong natural-term coverage ('Active Directory', 'on-prem AD', 'hybrid AD/Entra ID', 'ADCS', 'red team engagements') plus many technique keywords, but a few common user phrasings like 'pentest' or 'penetration test' are absent, keeping it just below comprehensive.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (offensive AD red-teaming) with distinct, specific triggers that are unlikely to fire for unrelated skills, minimizing conflict risk.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: SnailSploit/Claude-Red
Path: Skills/active-directory/offensive-active-directory/SKILL.md
Commit: 24d7968

Reviewed: ~7 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.