Menu

Individual skill

ad-opsec-telemetry

0upvotes

The telemetry each Active Directory technique generates and what alerts a defender: Kerberoasting produces Event 4769 with RC4 encryption (0x17) and an MDI alert, DCSync produces Event 4662 with the DS-Replication-Get-Changes GUID, AS-REP roasting produces Event 4768 with no pre-auth, LSASS dumping is blocked by EDR, plus a lateral-movement telemetry table by protocol (SMB/WMI/WinRM/RDP/DCOM). Use this whenever you run or plan an offensive AD technique and need to know what noise it makes, when writing the engagement's detection notes, or when a defender wants to know what to monitor. Teaches red teamers what is loud and blue teamers what to watch. Standard-tooling knowledge, no vendor engine.

skills/ad-opsec-telemetry/SKILL.md

Read pinned source

Source commit 73efec51207f6f740cb398e1c490e5edd60c1113

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
Yes
Repository scan complete
No
Skill scan complete
No
Observed behavior
Instructions only
Last checked
Nov 11, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
216
Repository last updated
Aug 24, 2026
License
MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# AD OPSEC and Telemetry

Every technique leaves a trace. The goal here is not evasion. It is knowing the noise
profile of each action so you can document it for the client before the engagement, pick
the quieter of two functionally equivalent techniques, and correlate what you did with what
their SOC saw. For a defender, read the same tables backwards: they are the events to
monitor and alert on.

Two rules of engagement throughout:

- **Document the noise.** Tell the client what each high-signal action generated, with the
  event ID and the source IP, so they can find it in their logs.
- **Coordinate the loud ones.** DCSync, mass spraying, coercion at scale, and LSASS dumps
  need explicit client sign-off or an end-of-engagement window when detection no longer
Back to top