Individual skill
defense-ad-defense
Detect and harden against Active Directory attacks — Kerberoasting, AS-REP roasting, DCSync, ADCS abuse, and delegation/relay. Load for "detect kerberoasting", "harden AD", "AD monitoring", "did someone DCSync us", or defending a domain. The defensive counterpart to the ad-* offensive skills.
skills/defense/defense-ad-defense/SKILL.md
Source commit ee0e0c50d2f6d941a14b73dd85a2b470d0ab976e
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- Yes
- Observed behavior
- Not checked yet
- Last checked
- Nov 7, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 27
- Repository last updated
- Oct 14, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- agent-skills Repository topic
- ai-agents Repository topic
- ai-security Repository topic
- application-security Repository topic
- blue-team Repository topic
- bug-bounty Repository topic
- claude-code Repository topic
- codex Repository topic
- detection-engineering Repository topic
- gemini Repository topic
- engineering Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 2,770 bytes
Read excerpt
# Active Directory defense
## When it applies
You run an AD domain and need to catch the standard attacker toolkit and close the structural weaknesses
it relies on — before or after a foothold.
## Why it works
Most AD attacks abuse features, not bugs, so they leave predictable event signatures and depend on
specific misconfigurations. Watch the right events and remove the preconditions, and the common
paths (the ones BloodHound finds) simply close.
## Method
1. **Kerberoasting (T1558.003)**: alert on Event `4769` (TGS request) with RC4 (`0x17`) encryption
or high volume from one account. Harden: strong (25+ char) managed service-account passwords,