Individual skill
executing-active-directory-attack-simulation
Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege paths, and exploitable trust relationships that could lead to domain compromise. The tester uses BloodHound for attack path analysis, Mimikatz for credential extraction, and Impacket for protocol-level attacks including Kerberoasting, AS-REP Roasting, and delegation abuse. Activates for requests involving Active Directory pentest, AD attack simulation, domain compromise testing, or Kerberos attack assessment.
skills/executing-active-directory-attack-simulation/SKILL.md
Source commit 54a798831d2266a3ca61ce68a7acb80b81160d57
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- Yes
- Observed behavior
- Local scripts
- Last checked
- Nov 9, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 35,926
- Repository last updated
- Aug 31, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- ai-agents Repository topic
- claude-code Repository topic
- cybersecurity Repository topic
- incident-response Repository topic
- mitre-attack Repository topic
- penetration-testing Repository topic
- red-team Repository topic
- security Repository topic
- cloud-security Repository topic
- malware-analysis Repository topic
- active-directory Declared skill tag
- bloodhound Declared skill tag
- mimikatz Declared skill tag
- kerberoasting Declared skill tag
- domain-compromise Declared skill tag
- security Derived category
- testing Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
LICENSEasset · 11,255 bytesSKILL.mdcore · 13,759 bytesreferences/api-reference.mddoc · 2,020 bytesscripts/agent.pyruns · 6,013 bytes
Read excerpt
# Executing Active Directory Attack Simulation
## When to Use
- Assessing the security of an Active Directory domain and forest against common and advanced attack techniques
- Identifying attack paths from low-privilege domain user to Domain Admin using privilege relationship analysis
- Validating that Kerberos security configurations, credential policies, and delegation settings resist known attacks
- Testing detection capabilities of the SOC and EDR tools against Active Directory-specific TTPs
- Evaluating the effectiveness of tiered administration models and privileged access workstations
**Do not use** without explicit written authorization from the domain owner, against production domain controllers during business hours unless approved, or for testing that could cause account lockouts affecting real users without prior coordination.
## Prerequisites
- Written authorization specifying the target AD domain, testing constraints, and any off-limits accounts or systems