Claude-AD README

The project's README from github.com/ADScanPro/Claude-AD. As one markdown file: README.md.

Claude-AD

Active Directory pentest methodology for Claude Code.

License: MIT Claude Code plugin Version Techniques

Skills, agents and commands that give Claude the playbook for an internal Active Directory assessment: the phase order, the environment constraints that break your tooling, the telemetry each technique leaves behind, and how a finding maps to a compliance control. It drives standard tooling (netexec, impacket, certipy, bloodyAD, BloodHound CE). You still run the engagement; Claude carries the method.

What this is

Every AD assessment follows the same spine: map before you exploit, harvest the easy credentials before you spray, collect the graph before you reason about paths. That spine, plus the hundred small constraints a hardened domain throws at you (NTLM disabled, AES-only Kerberos, LDAP channel binding, SPNs that must be FQDNs), is what separates an operator who finishes the engagement from one who spends a day debugging invalidCredentials.

Claude-AD encodes that method as Claude Code skills so Claude runs the standard tools in the right order, reads the environment correctly, and tells you what each step will look like to a defender.

It covers:

It orchestrates third-party tools. BloodHound CE (Apache-2.0), impacket, certipy, netexec and bloodyAD do the work; Claude-AD is the method that drives them.

Install

Claude-AD is a Claude Code plugin. From inside Claude Code:

/plugin marketplace add ADScanPro/Claude-AD
/plugin install claude-ad@claude-ad

The first line registers this repo as a marketplace; the second installs the plugin. Once installed, the skills load automatically when you work on an AD engagement, and the commands (/ad-scope, /ad-recon, /ad-attack-paths) are available.

Layout

Claude-AD/
├── skills/
│   ├── ad-methodology/          # phase order and why
│   ├── ad-environment-constraints/  # what breaks your tooling in a hardened domain
│   ├── ad-opsec-telemetry/      # Event IDs and MDI alerts per technique
│   ├── kerberos-attacks/        # Kerberoasting, AS-REP, delegation
│   ├── adcs-attacks/            # ESC1-ESC17 with certipy
│   ├── acl-abuse/               # GenericAll, WriteDACL, replication rights
│   ├── coercion-ntlm-relay/     # PetitPotam/PrinterBug/DFSCoerce + ntlmrelayx
│   └── compliance-mapping/      # conceptual technique -> DORA/NIS2/ENS control
├── agents/
│   ├── ad-enumerator.md         # runs collection with standard tooling
│   ├── ad-attack-planner.md     # reasons low-priv -> Domain Admin paths
│   └── ad-exploit-operator.md   # executes one step, with a human gate
└── commands/
    ├── ad-scope.md
    ├── ad-recon.md
    └── ad-attack-paths.md

Scope and ethics

This is for authorized engagements only: your own lab, a domain you are contracted to test, a CTF. The exploitation agents ask for confirmation before any action that modifies the directory (a password reset, a group add, an RBCD write), and note where rollback applies. Use it where you have permission to.

Where Claude-AD ends and ADscan begins

Claude-AD gives you the method. It tells Claude what to run, in what order, what each technique looks like on the wire, and which compliance control it touches. You still drive every tool by hand and read every result yourself.

ADscan is the engine. It runs the whole chain from a low-privilege user to Domain Admin on its own, on-prem, with guardrails and rollback, and turns the result into a report with control IDs a DORA, NIS2 or ENS auditor will accept. Where this repo hands Claude the playbook, ADscan is the tool that executes it end to end and writes the evidence.

ADscan is free and source-available. If the manual method here is useful and you want it run and mapped for you, that is what it is for.

Prior art and references

Claude-AD stands on the shoulders of the community. The techniques it encodes are documented in depth at The Hacker Recipes, the reference every skill here points back to for exact syntax. It sits alongside the growing set of Claude Code security collections (Claude-OSINT, Claude-BugHunter, claude-pentest), filling the Active-Directory-internal gap those bundles leave open. The tooling it drives (BloodHound CE, impacket, certipy, netexec, bloodyAD) is the work of their respective authors.

Contributing

New techniques, sharper detection guidance, corrections to the compliance mapping: open an issue or a PR. Keep it AD-internal and keep the commands real.

License

MIT. See LICENSE. ADscan itself is a separate product under the Business Source License 1.1 (source-available).

Keywords: Active Directory penetration testing · Claude Code skills · red team · Kerberoasting · AS-REP roasting · ADCS ESC1-ESC17 · DCSync · ACL abuse · NTLM relay & coercion (PetitPotam, PrinterBug, DFSCoerce) · Kerberos delegation · BloodHound CE attack paths · OPSEC & MDI telemetry · DORA / NIS2 / ENS compliance mapping · netexec · impacket · certipy · bloodyAD.

Claude-AD (ADScanPro/Claude-AD)

Searching Database…

211 ·GitHub
Claude-AD
这是什么？Claude-AD 是一个 Claude Code 插件，向 Claude 传授内部 Active Directory 渗透测试的方法论：技能、代理和斜杠命令覆盖 Kerberoasting、ADCS ESC1-17、DCSync、ACL 滥用、NTLM 中继和委派滥用，每一项都附带 OPSEC 和遥测说明。
它本身是一个扫描工具，还是告诉 Claude 该运行什么的东西？它不是扫描器——它是编码为 Claude Code 技能的方法论。Claude 会告诉你阶段顺序和正确的命令，但你仍然要自己运行 netexec、impacket、certipy、bloodyAD 和 BloodHound CE，并阅读结果。
要真正执行这些攻击，我需要预先装好哪些工具？你需要自己安装标准的 AD 渗透测试工具集：netexec、impacket、certipy、bloodyAD 和 BloodHound CE。Claude-AD 既不捆绑也不替代它们，只是告诉你该运行哪一个以及怎么运行。
它会替我自动执行实际的攻击链吗？不会，Claude-AD 只提供方法：操作顺序、OPSEC 注意事项、检测事件。从低权限用户一路自动跑到 Domain Admin、端到端执行整条攻击链的是另一个叫 ADscan 的产品。
它在哪里运行？Claude Code 能跑的地方它就能跑，也就是 macOS、Linux 和 Windows，因为它是作为 Claude Code 插件安装的，而不是独立应用。
整个项目的许可证都一样吗？这个仓库采用 MIT 许可证，但相关的全自动化产品 ADscan 是一个独立的工具，采用 Business Source License 1.1（源码可见），并不是 MIT。
它覆盖哪些 AD 攻击技术？Kerberoasting 和 AS-REP roasting、ADCS ESC1 到 ESC17、ACL 滥用（GenericAll/WriteDACL/复制权限）、强制认证与 NTLM 中继（PetitPotam、PrinterBug、DFSCoerce），以及 Kerberos 委派滥用。
合规映射功能是干什么用的？每项技术都会在概念上映射到 DORA、NIS2 和 ENS 法规下它所涉及的控制族，把技术发现转化为可直接用于审计的合规说明。
它能防止我在域里不小心搞坏东西吗？可以，利用阶段的代理在执行任何会修改目录的操作（如重置密码、添加组成员或写入 RBCD）之前都会请求确认，并注明哪些地方适用回滚。
这个仓库和 ADscan 有什么区别？Claude-AD 是由你手动驱动的方法论；ADscan 是一个独立的、源码可见的引擎，能自动端到端执行同样的攻击链，并生成审计人员可直接使用的报告。
What are similar projects?Claude-Red, Decepticon, Anthropic-Cybersecurity-Skills, bug-bounty-hunting-prompts, evilginx2, dirsearch, CVE-2026-62911, nishang
Which topics is it in?pentest-tool, mitre-attack, ethical-hacking, redteam, compliance, security-research, infosec, claude-code-plugin, hacking-tool, offensive-security, red-team, pentesting
Creator
ADScanPro
Size
<0.1 MB
Stars
211
Updated
CommitAug 24
Age
1mo
Commits · 90 Days