菜单
Assess Active Directory security posture using PingCastle, BloodHound, and Purple Knight to identify misconfigurations, privilege escalation paths, and attack vectors.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/nexuslinkproductions/yuri-os --skill cyber-performing-active-directory-vulnerability-assessment命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] Extract DPAPI-protected secrets such as credentials and browser data offline and online.
[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] Take over Active Directory user and computer accounts by writing alternate certificate keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, and Certipy, then authenticate via PKINIT.
>- Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, compute the SPRS score with the DoD Assessment Methodology, manage a compliant POA&M, and ready the organization for a C3PAO assessment. Use when an organization handles Controlled Unclassified Information (CUI) under a DoD
基于 SOC 职业分类
正在显示 SKILL.md
| name | cyber-performing-active-directory-vulnerability-assessment |
| description | Assess Active Directory security posture using PingCastle, BloodHound, and Purple Knight to identify misconfigurations, privilege escalation paths, and attack vectors. |
| source | mukul975/Anthropic-Cybersecurity-Skills |
| license | Apache-2.0 |
| authorized_lab | false |
| origin_frontmatter | name: performing-active-directory-vulnerability-assessment | description: Assess Active Directory security posture using PingCastle, BloodHound, | and Purple Knight to identify misconfigurations, privilege escalation paths, and | attack vectors. | domain: cybersecurity | subdomain: vulnerability-management | tags: | - active-directory | - pingcastle | - bloodhound | - purple-knight | - ad-security | - privilege-escalation | - ldap | - kerberos | version: '1.0' | author: mahipal | license: Ap |
| hide | true |
Defensive/analysis cyber skill. Source: mukul975/Anthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.
Active Directory (AD) is the primary identity and access management system in most enterprise environments, making it a critical attack target. This skill covers comprehensive AD security assessment using PingCastle for health checks, BloodHound for attack path analysis, and Purple Knight for security posture scoring. These tools identify misconfigurations, excessive privileges, Kerberos weaknesses, and lateral movement opportunities.
# Download PingCastle
Invoke-WebRequest -Uri "https://github.com/netwrix/pingcastle/releases/latest/download/PingCastle.zip" `
-OutFile "PingCastle.zip"
Expand-Archive PingCastle.zip -DestinationPath C:\Tools\PingCastle
# Run health check against current domain
cd C:\Tools\PingCastle
.\PingCastle.exe --healthcheck
# Run health check against specific domain
.\PingCastle.exe --healthcheck --server dc01.corp.local --user CORP\scanner_account --password P@ssw0rd
# Run in scanner mode for multiple domains
.\PingCastle.exe --scanner --scannerlp
# Generate consolidated report
.\PingCastle.exe --healthcheck --level Full
| Category | Description | Risk Areas |
|---|---|---|
| Stale Objects | Inactive accounts, old passwords, obsolete OS | Ghost accounts, expired credentials |
| Privileged Accounts | Excessive admin rights, nested groups |
| Domain Admin sprawl, SID history |
| Trusts | Forest and domain trust configurations | Transitive trust abuse, SID filtering |
| Anomalies | Security setting deviations | GPO misconfigurations, schema issues |
# Critical items to review in PingCastle report:
- Accounts with "Password Never Expires" flag
- Accounts with Kerberos pre-authentication disabled (AS-REP roastable)
- Accounts with Kerberos delegation (unconstrained/constrained)
- Domain Controllers running unsupported OS versions
- AdminSDHolder permission modifications
- Accounts in privileged groups (Domain Admins, Enterprise Admins, Schema Admins)
- Trust relationships with SID filtering disabled
- GPO vulnerabilities allowing privilege escalation
# Download SharpHound collector
# https://github.com/SpecterOps/BloodHound/tree/main/packages/csharp/SharpHound
# Run SharpHound collection (all methods)
.\SharpHound.exe --collectionmethods All --domain corp.local --zipfilename bloodhound_data.zip
# Stealthy collection (minimal noise)
.\SharpHound.exe --collectionmethods Session,LoggedOn --domain corp.local --stealth
# Collection with specific domain controller
.\SharpHound.exe --collectionmethods All --domain corp.local --domaincontroller dc01.corp.local
# Run via PowerShell
Import-Module .\SharpHound.ps1
Invoke-BloodHound -CollectionMethod All -Domain corp.local -OutputDirectory C:\BH_Data
# Deploy BloodHound Community Edition with Docker
curl -L https://ghst.ly/getbhce -o docker-compose.yml
docker compose up -d
# Access BloodHound CE at http://localhost:8080
# Default credentials shown in docker compose logs
# Upload SharpHound data through web UI or API
curl -X POST "http://localhost:8080/api/v2/file-upload/start" \
-H "Authorization: Bearer $BH_TOKEN" \
-H "Content-Type: application/json" \
-d '{"fileName": "bloodhound_data.zip"}'
# Find shortest path to Domain Admin
MATCH p=shortestPath((u:User)-[*1..]->(g:Group {name:"DOMAIN ADMINS@CORP.LOCAL"}))
WHERE u.name <> "ADMINISTRATOR@CORP.LOCAL"
RETURN p
# Find Kerberoastable accounts with admin privileges
MATCH (u:User {hasspn:true})-[:MemberOf*1..]->(g:Group)
WHERE g.name CONTAINS "ADMIN"
RETURN u.name, u.serviceprincipalnames
# Find computers where Domain Admins are logged in
MATCH (c:Computer)-[:HasSession]->(u:User)-[:MemberOf*1..]->(g:Group {name:"DOMAIN ADMINS@CORP.LOCAL"})
RETURN c.name, u.name
# Find AS-REP roastable accounts
MATCH (u:User {dontreqpreauth:true})
RETURN u.name, u.description
# Find unconstrained delegation hosts
MATCH (c:Computer {unconstraineddelegation:true})
WHERE NOT c.name CONTAINS "DC"
RETURN c.name
# Find GPO abuse paths
MATCH p=(u:User)-[:GenericAll|GenericWrite|WriteOwner|WriteDacl]->(g:GPO)
RETURN p
# Download Purple Knight from https://www.purple-knight.com/
# Run as domain admin or with appropriate read permissions
.\PurpleKnight.exe
# Purple Knight checks 130+ security indicators across:
# - Account Security (password policies, privileged accounts)
# - AD Infrastructure (replication, DNS, LDAP signing)
# - Group Policy (GPO permissions, security settings)
# - Kerberos Security (delegation, encryption types, SPN)
# - AD Delegation (AdminSDHolder, OU permissions)
| Score Range | Rating | Action Required |
|---|---|---|
| 90-100 | Excellent | Maintain current posture |
| 75-89 | Good | Address high-risk findings |
| 60-74 | Fair | Prioritize remediation plan |
| 40-59 | Poor | Immediate remediation required |
| 0-39 | Critical | Emergency response needed |
# Find SPNs assigned to user accounts (Kerberoasting targets)
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName |
Select-Object Name, ServicePrincipalName, PasswordLastSet, Enabled
# Find accounts with pre-auth disabled
Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true} -Properties DoesNotRequirePreAuth |
Select-Object Name, DoesNotRequirePreAuth, Enabled
# Check if LLMNR is disabled via GPO
Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" -Name EnableMulticast -ErrorAction SilentlyContinue
# Count members in critical groups
$groups = @("Domain Admins", "Enterprise Admins", "Schema Admins", "Account Operators", "Backup Operators")
foreach ($group in $groups) {
$count = (Get-ADGroupMember -Identity $group -Recursive).Count
Write-Output "$group : $count members"
}
| Finding | Risk | Remediation |
|---|---|---|
| Kerberoastable admin accounts | Critical | Remove SPNs or use MSA/gMSA |
| Unconstrained delegation on non-DCs | Critical | Switch to constrained/RBCD |
| Password Never Expires on admins | High | Enable password rotation policy |
| AS-REP roastable accounts | High | Enable Kerberos pre-authentication |
| AdminSDHolder modification | High | Audit and restore default ACLs |
| Stale computer accounts (90+ days) | Medium | Disable and move to quarantine OU |
| LDAP signing not enforced | Medium | Enable via GPO on all DCs |