ad-overview
Active Directory attack lane — BloodHound ingestion, Kerberoasting, ADCS ESC scanning, DCSync, LAPS extraction.
ソース情報
- リポジトリ
- BitterSecurity/Decepticon
- ソースの最終更新活動
- 2026年8月17日 22:24
- 検出された SKILL.md の言語
- 英語
- スター
- 5,565
- フォーク
- 1,053
インストール方法
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
ソースファイルを確認
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
ファイルエクスプローラー
12 ファイルSKILL.md を表示中
SKILL.md
ソースの指示 · 読み取り専用プレビュー- name
- ad-overview
- description
- Active Directory attack lane — BloodHound ingestion, Kerberoasting, ADCS ESC scanning, DCSync, LAPS extraction.
- metadata
- {"subdomain":"active-directory","when_to_use":"active directory ad attack lane overview routing bloodhound kerberoast adcs dcsync laps domain compromise","mitre_attack":["T1078.002","T1558.003","T1558.004","T1003.006","T1649","T1555"],"capability_contract":{"lane":"active-directory","scope":"isolated-lab","environment":["resettable-ad-lab","isolated-network"],"required_tools":["bloodhound-ce","certipy","netexec"],"evidence":["attack-path-query","lab-replay","remediation-check"],"verification":"replay the exact path in a freshly reset authorized lab","negative_control":"confirm the path fails after the remediated control is applied","scorecard":["verified-path-rate","noisy-action-rate","remediation-correctness"],"benchmark":"dreadgoad"}}
# AD Operator Skill Catalog
## Playbooks
| Skill | Use for |
|---|---|
| `/skills/standard/ad/bloodhound-query/SKILL.md` | Ingest + common Cypher queries |
| `/skills/standard/ad/kerberoasting/SKILL.md` | Roast SPN users, crack with hashcat |
| `/skills/standard/ad/asrep-roasting/SKILL.md` | dontreqpreauth users |
| `/skills/standard/ad/adcs-esc1/SKILL.md` | ESC1 template abuse → domain admin |
| `/skills/standard/ad/dcsync/SKILL.md` | Replication rights → krbtgt dump |
| `/skills/standard/ad/laps/SKILL.md` | LAPS local admin password extraction |
| `/skills/standard/ad/netexec/SKILL.md` | NetExec (formerly CrackMapExec) cheatsheet — SMB/WinRM/LDAP/MSSQL modules |
## Workflow
1. Collect: `bash("bloodhound-python -u user -p pass -d DOMAIN -c all --zip")`
2. `bh_ingest_zip("/workspace/bh.zip")`
3. `dcsync_check` — if any principal, that's instant domain compromise
4. `kg_query(kind="user")` and filter for `hasspn=true` → Kerberoast queue
5. `kg_query(kind="user")` and filter for `dontreqpreauth=true` → AS-REP roast
6. ADCS: `bash("certipy find -u user -p pass -dc-ip X -json")` then `adcs_audit`
7. `plan_attack_chains` to see graph-computed domain compromise paths
## Crown jewels to add
```
kg_add_node(kind="crown_jewel", label="Domain Admins group")
kg_add_node(kind="crown_jewel", label="krbtgt account")
kg_add_node(kind="crown_jewel", label="DC: DC01.corp.local")
```
GitHubで見る