Evaluris-Solutions/claude-active-directory
Instructions file
Claude Code instructions for Evaluris-Solutions/claude-active-directory, covering claude active directory — plugin guide, what's here, commands (13 slash commands — same filenames), agents (7) and rules (always active).
Evaluris-Solutions/claude-active-directory
Skill Claude CodeCodex
Claude Active Directory — authorized AD offensive security master skill. ROE, recon, Kerberos and NTLM, coercion awareness, delegation and ACL abuse, AD CS ESC1–ESC11, lateral movement, MITRE-ready validation and reporting. Evaluris Solutions, pentest, red team.
Evaluris-Solutions/claude-active-directory
Agent
Use when Active Directory Certificate Services or PKI is in scope and templates, enrollment ACLs, CA endpoints, or ESC-pattern alignment need specialist review—typically alongside /web3-audit. Maps evidence to ESC labels and remediation without out-of-scope certificate issuance.
Evaluris-Solutions/claude-active-directory
Agent
Use when an operator wants a phased checklist for an authorized AD engagement with explicit ROE checkpoints between recon, rank, hunt, validate, and report. Structures work; does not bypass human approval or /scope.
Evaluris-Solutions/claude-active-directory
Agent
Use when several confirmed Active Directory primitives must be combined into one defensible multi-hop narrative for reporting or validation. Covers Kerberos, delegation, ACL abuse, AD CS, and lateral steps with evidence per hop. Does not invent hops that were not demonstrated.
Evaluris-Solutions/claude-active-directory
Agent
Use when starting authorized Active Directory reconnaissance. Guides DNS SRV resolution, LDAP and RPC enumeration, Kerberos user and SPN discovery, password policy and spray gates, and BloodHound collection planning strictly within ROE. Does not perform credential attacks—that belongs to hunt workflows after scope…
Evaluris-Solutions/claude-active-directory
Agent
Use when recon or BloodHound output exists and the operator needs a prioritized list of where to spend time next. Ranks Tier-0 proximity, Kerberoast density, delegation hints, AD CS presence, and stale accounts. Does not replace /scope or execute attacks.
Evaluris-Solutions/claude-active-directory
Agent
Use when validated Active Directory findings must become a professional internal or red team report. Follows engagement-reporting structure for executive summary, scope, methodology, findings, and remediation. Assumes validator has PASS or agreed DOWNGRADE on included items.
Evaluris-Solutions/claude-active-directory
Agent
Use when a single Active Directory finding needs QA before customer or management delivery. Applies evidence, ROE, impact, and false-positive gates from the finding-validation skill. Does not write full reports—that is report-writer after PASS.
Evaluris-Solutions/claude-active-directory
Command
Phased autonomous checklist for AD engagements within ROE — not unsupervised internet-wide scanning. Usage: /autopilot corp.local --normal.
Evaluris-Solutions/claude-active-directory
Command
Build multi-hop Active Directory attack paths — combine AS-REP, Kerberoast, delegation, ACL abuse, AD CS, lateral steps into one narrative. Usage: /chain.
Evaluris-Solutions/claude-active-directory
Command
Active Directory offensive phase — credential attacks (spray if allowed), AS-REP and Kerberoast workflows, NTLM relay opportunities, delegation abuse paths, ACL-based escalation, AD CS template abuse, lateral movement within ROE. Usage: /hunt corp.local.
Evaluris-Solutions/claude-active-directory
Command
Domain controller and Windows Server build intel — patch level, known abuse techniques relevant to version, planning prioritization. Usage: /intel corp.local.
Evaluris-Solutions/claude-active-directory
Command
Active Directory reconnaissance — DNS SRV/LDAP DC discovery, LDAP user and group enumeration, Kerberos pre-auth and AS-REP candidates, SPN discovery for Kerberoasting, SMB signing and null session policy, password policy, trust relationships, BloodHound/SharpHound collection prep. Requires ROE. Usage: /recon…
Evaluris-Solutions/claude-active-directory
Command
Log a technique, finding, or pattern to engagement memory for later reuse. Usage: /remember.
Evaluris-Solutions/claude-active-directory
Command
Generate internal penetration test / red team report structure for Active Directory engagements — executive summary, scope, methodology, findings, remediation. Usage: /report.
Evaluris-Solutions/claude-active-directory
Command
Resume a previous Active Directory engagement — read journal, recon folder, and untested paths. Usage: /resume corp.local.
Evaluris-Solutions/claude-active-directory
Command
Rules of engagement — verify authorized domains, DCs, subnets, accounts, destructive actions, and exclusions before testing. Usage: /scope or /scope corp.local.
Evaluris-Solutions/claude-active-directory
Command
Rank and prioritize Active Directory attack surface — high-value hosts, Tier-0 proximity, Kerberoastable accounts, AD CS CAs, delegation flags. Usage: /surface corp.local.
Evaluris-Solutions/claude-active-directory
Command
Quick go/no-go on a suspected AD finding before deep validation. Usage: /triage.
Evaluris-Solutions/claude-active-directory
Command
Validate an Active Directory finding for internal reporting — reproducibility, ROE, impact, evidence quality. Usage: /validate.
Evaluris-Solutions/claude-active-directory
Command
AD CS and PKI security review — enterprise CA inventory, certificate templates, enrollment permissions, ESC-pattern triage with Certipy-style methodology, optional web enrollment attack surface. Filename legacy; content is PKI only. Usage: /web3-audit or /web3-audit corp.local.
Evaluris-Solutions/claude-active-directory
Skill Claude CodeCodex
Use when selecting command patterns for authorized AD testing or when documenting OPSEC and defender-visible telemetry—NetExec/CrackMapExec, Impacket, Certipy, SharpHound, representative Windows Event IDs, and certificate enrollment logs. Use to enrich report appendices and kickoff expectations, not for EDR evasion…
Evaluris-Solutions/claude-active-directory
Skill Claude CodeCodex
Use when classifying or explaining authorized Active Directory attack techniques—Kerberos and NTLM paths, coercion awareness, delegation and RBCD, ACL and DCSync concepts, LAPS and shadow credentials, GPP, trust paths, AD-joined SQL pivots, and lateral movement by protocol. Use as a reference when writing findings or…