Menu
Decision tree for Active Directory enumeration. Maps enumeration tasks to tools, defines priority signals, and specifies what findings trigger deeper investigation. Use during the enumeration phase of network operations.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Use when beginning a web assessment from a domain, wildcard, ASN, organization, IP list, or CIDR and measurable attack-surface coverage is needed.
Decision tree for selecting AIRT attacks based on goals, target type, and constraints
Common Active Directory attack chains with tool mappings. Covers Kerberoasting, AS-REP roasting, RBCD, AD CS, DCSync, relay attacks, and credential reuse patterns. Use during exploitation and privilege escalation phases.
Load when performing network operations or Active Directory exploitation. Enforces enumeration-before-attack discipline, credential verification, trust boundary awareness, scope compliance, reversibility preference, and structured reporting. Prevents premature exploitation, credential misuse, and scope violations.
Direct Caido interaction via the caido-sdk-client Python library, bypassing the Caido MCP server. Prefer this over the caido-proxy MCP skill for efficiency WHEN the SDK is importable in the current runtime. If the import fails, or Caido/the MCP is not loaded, fall back to the caido-proxy skill.
Caido proxy integration for HTTP history search, request replay, fuzzing results, sitemap, and security findings via MCP. Use when you need to search proxy traffic, replay requests with modifications, triage fuzzing results, or document findings in Caido.
| name | ad-enumeration-playbook |
| description | Decision tree for Active Directory enumeration. Maps enumeration tasks to tools, defines priority signals, and specifies what findings trigger deeper investigation. Use during the enumeration phase of network operations. |
Systematic enumeration produces the attack surface map that drives exploitation. Follow this decision tree to maximize coverage with minimum noise.
Execute in this order. Each phase feeds the next — skip nothing.
Establish the AD landscape before enumerating objects.
| Task | Tool | Command Pattern |
|---|---|---|
| Identify domain controllers | netexec SMB scan + identify DCs | netexec_smb across target range |
| Domain/forest trust relationships | netexec LDAP --trusted-for-delegation or SharpView get_domain_trust | Trust direction determines lateral movement feasibility |
| Password policy | netexec SMB --pass-pol | Must retrieve before any credential spraying |
| Domain functional level | netexec LDAP or SharpView get_domain | Determines available attack techniques |
| Task | Tool | Priority Signal |
|---|---|---|
| All domain users | netexec LDAP --users or SharpView get_domain_user | High-privilege groups, service accounts, descriptions with passwords |
| All domain groups | netexec LDAP --groups or SharpView get_domain_group | Domain Admins, Enterprise Admins, custom admin groups |
| Group membership (recursive) | SharpView get_domain_group_member with recurse | Nested group memberships reveal hidden admin access |
| Kerberoastable accounts (SPNs) | netexec LDAP --kerberoasting or SharpView get_domain_user with SPN filter | Immediate attack signal — queue for Kerberoasting |
| AS-REP roastable accounts | netexec LDAP --asreproast or SharpView get_domain_user with PreauthNotRequired | Immediate attack signal — queue for AS-REP roasting |
| Task | Tool | Priority Signal |
|---|---|---|
| All domain computers | SharpView get_domain_computer | Operating system versions, stale accounts |
| Sessions and logged-on users | SharpView get_net_session, get_net_loggedon | Where high-value users are logged in |
| Local admin access | SharpView find_local_admin_access | Hosts where current creds have admin |
| Shares and sensitive files | netexec SMB --shares, SharpView find_domain_share | READ/WRITE shares, sensitive file names |
| Task | Tool | Priority Signal |
|---|---|---|
| Unconstrained delegation | SharpView get_domain_computer with Unconstrained filter | High-value attack target — Kerberos relay |
| Constrained delegation | SharpView get_domain_computer or get_domain_user with delegation filter | S4U2Proxy exploitation paths |
| RBCD candidates | BloodyAD bloodyad_get_writable or SharpView ACL queries | Objects where you can write msDS-AllowedToActOnBehalfOfOtherIdentity |
| Interesting ACLs | SharpView find_interesting_domain_acl | GenericAll, WriteDACL, WriteOwner on high-value targets |
| AD CS templates | Certipy find | Vulnerable templates (ESC1-ESC8) |
When enumeration reveals these signals, queue the corresponding action:
| Signal | Next Action |
|---|---|
| User with SPN | Kerberoast → crack → test credential |
| User with PreauthNotRequired | AS-REP roast → crack → test credential |
| Writable object (GenericAll, WriteDACL) | Plan ACL abuse via BloodyAD |
| Unconstrained delegation host | Plan Kerberos relay via Krbrelayx |
| Constrained delegation | Plan S4U exploitation via Impacket |
| AD CS vulnerable template | Plan certificate abuse via Certipy |
| Share with READ access | Access and review for credentials/configs |
| User description containing password hints | Test as credential |
| Stale computer accounts | Potential machine account takeover |
| Need | First Choice | Alternative |
|---|---|---|
| Bulk user/group enumeration | netexec LDAP | SharpView (more filters) |
| SMB share enumeration | netexec SMB --shares | SharpView get_net_share |
| ACL analysis | SharpView find_interesting_domain_acl | BloodyAD bloodyad_get_writable |
| Trust enumeration | SharpView get_domain_trust | netexec LDAP |
| Session enumeration | SharpView get_net_session | netexec SMB --sessions |
| Kerberoastable discovery | netexec LDAP --kerberoasting | SharpView with SPN filter |
| Certificate enumeration | Certipy find | — |
| DNS enumeration | BloodyAD bloodyad_get_dnsdump | SharpView get_domain_dns_record |
