analyzing-active-directory-acl-abuse
From the author
Detect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and WriteOwner abuse paths
Install
npx skills add 26zl/cybersec-toolkit --skill analyzing-active-directory-acl-abuse -a claude-code
Installs to .claude/skills/analyzing-active-directory-acl-abuse/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
- Ships scripts we have not reviewedLow
Why 77
Security85
Provenance63
Maintenance100
Licence100
Adoption33
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- acl-abuseADScanPro/Claude-ADAbusing Active Directory object ACLs (DACL/ownership) for privilege escalation and lateral movement (GenericAll, GenericWrite, WriteDACL, WriteOwner, AddMember, ForceChangePassword, and replication rights via DS-Replication-Get-Changes-All). Use when BloodHound CE shows an outbound control edge from a principal you own toward a higher-value object, and you want the exact bloodyAD/impacket command to weaponize that ACE, plus detection and remediation. DCSync is covered here strictly as a post-compromise technique, not a user entry path.Writing★ 215
- adcs-exposure-auditzero-lab-ai/skillsAudits Active Directory Certificate Services configuration for dangerous certificate templates, PKI ACLs, enrollment interfaces, mapping policy, and identity escalation paths. Use during an authorized identity security review when assessing AD CS, certificate templates, enterprise CAs, or Certipy-style inventory without exercising an attack path.Security★ 282
- offensive-active-directorySnailSploit/Claude-RedActive Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalation (ACL abuse, GPO abuse, unconstrained/constrained delegation), lateral movement (Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, WMI/WinRM/PsExec), persistence (Golden/Silver/Diamond Tickets, DCSync, DCShadow, AdminSDHolder, Skeleton Key), forest trust attacks, ADCS abuse (ESC1-ESC15), and modern MDI/Defender for Identity evasion. Use when assessing on-prem AD, hybrid AD/Entra ID environments, or ADCS deployments.DevOps★ 9K
- detecting-service-account-abuse26zl/cybersec-toolkitDetect abuse of service accounts through anomalous interactive logons, privilege escalation, lateral movement, and unauthorized access patterns.Other★ 82
- active-directory-attack-pathzero-lab-ai/skillsAnalyzes and prioritizes Active Directory and BloodHound attack paths using evidence freshness, disabled principals, prerequisites, authorization, operational noise, and remediation coverage. Use during an authorized red-team operation when reviewing AD graphs, nested groups, ACL abuse, delegation, sessions, GPO control, or routes to Tier Zero.Marketing★ 282
- auditing-aws-s3-bucket-permissions26zl/cybersec-toolkitSystematically audit AWS S3 bucket permissions to identify publicly accessible buckets, overly permissive ACLs, misconfigured bucket policies, and missing encryption settings using AWS CLI, S3audit, and Prowler to enforce least-privilege data access controls.DevOps★ 82
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in