Ad Opsec Telemetry
ADScanPro/Claude-ADThe telemetry each Active Directory technique generates and what alerts a defender: Kerberoasting produces Event 4769 with RC4 encryption (0x17) and an MDI alert, DCSync produces Event 4662 with the DS-Replication-Get-Changes GUID, AS-REP roasting produces Event 4768 with no pre-auth, LSASS dumping is blocked by EDR, plus a lateral-movement telemetry table by protocol (SMB/WMI/WinRM/RDP/DCOM). Use this whenever you run or plan an offensive AD technique and need to know what noise it makes, when writing the engagement's detection notes, or when a defender wants to know what to monitor. Teaches...
At a glance
This skill is for Support and helps you identify active directory attack telemetry, plan ad technique detection evasion, and document ad offensive engagement detections.
/plugin marketplace add ADScanPro/Claude-AD
/plugin install ad-opsec-telemetry
Setup, runtime and requirements describe ADScanPro/Claude-AD, the repo this skill ships in.
active-directoryKerberoastingDcsyncTelemetryEdrSiem
Also in ADScanPro/Claude-AD
View the repoAbusing Active Directory object ACLs (DACL/ownership) for privilege escalation and lateral movement (GenericAll, GenericWrite, WriteDACL, Wr...
Active Directory Certificate Services (AD CS) escalation techniques ESC1 through ESC17, driven by hand with Certipy (ly4k). Use when the tar...
Real-world Active Directory environment constraints that silently break attacks when ignored: NTLM disabled (Kerberos fallback), AES-only KD...
The order of operations for an Active Directory penetration test: setup, collection, exploitation, post-processing. Use this whenever you ar...
Authentication coercion (PetitPotam MS-EFSR, PrinterBug MS-RPRN, DFSCoerce MS-DFSNM) chained into NTLM relay (impacket ntlmrelayx) toward LD...
A high-level conceptual mapping from Active Directory attack techniques to the compliance controls they touch. Kerberoasting relates to auth...
Kerberos-based Active Directory attacks driven by hand with standard tooling (Kerberoasting, AS-REP roasting, and delegation abuse: unconstr...
Other Support skills
Break a plan, spec, or the current conversation into a set of tracer-bullet tickets, each declaring its blocking edges, published to the con...
Implement a piece of work based on a spec or set of tickets.
Plan a huge chunk of work — more than one agent session can hold — as a shared map of decision tickets on your issue tracker, and resolve th...
Google Model Armor: Filter user-generated content for safety.
Manage customer support — track tickets, respond, escalate issues.
Integrates with Atlassian products to manage project tracking and documentation via MCP protocol. Use when querying Jira issues with JQL fil...