Individual skill
ad-methodology
The order of operations for an Active Directory penetration test: setup, collection, exploitation, post-processing. Use this whenever you are planning or driving an AD assessment and need to know what to run before what and why (map before you exploit; harvest easy credentials before spraying to avoid lockouts; collect the graph before you reason about paths). Covers phase sequencing with standard tooling: netexec/nxc, impacket, certipy, bloodyAD, kerbrute, BloodHound CE. Invoke it at the start of an engagement, when deciding the next phase, or when a step feels out of order.
skills/ad-methodology/SKILL.md
Source commit 73efec51207f6f740cb398e1c490e5edd60c1113
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Not checked yet
- Last checked
- Nov 6, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 216
- Repository last updated
- Aug 24, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- active-directory Repository topic
- active-directory-security Repository topic
- adcs Repository topic
- bloodhound Repository topic
- claude Repository topic
- claude-code Repository topic
- claude-code-plugin Repository topic
- claude-skills Repository topic
- dcsync Repository topic
- kerberoasting Repository topic
- operations Derived category
- testing Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 11,504 bytesSKILL.mdcore · 11,504 bytesSKILL.mdcore · 11,504 bytesSKILL.mdcore · 11,504 bytesSKILL.mdcore · 11,504 bytesSKILL.mdcore · 11,504 bytesSKILL.mdcore · 11,504 bytesSKILL.mdcore · 11,504 bytesSKILL.mdcore · 11,504 bytesSKILL.mdcore · 11,504 bytesSKILL.mdcore · 11,504 bytesSKILL.mdcore · 11,504 bytes
Read excerpt
# AD Pentest Methodology: Phase Order
A domain assessment is not a bag of tricks you run in random order. The order is the
craft. Enumeration feeds exploitation; a credential harvested cheaply saves you a spray
that locks accounts; a graph collected once tells you which of a hundred possible attacks
actually reaches Domain Admin. Run the phases in order and each one narrows the next.
Four phases, in sequence:
1. **Setup**: reachability, name resolution, environment posture, first credentials.
2. **Collection**: topology, trusts, directory objects, hosts, shares. Read, do not touch.
3. **Exploitation**: attack-path discovery, then cheap wins, then spraying, then hunting.
4. **Post-processing**: consolidate loot, re-collect as the owned set grows, report.
