hunting-active-directory-acl-abuse-paths SKILL.md skillA
hunting-active-directory-acl-abuse-paths from unboundcompute/security-agent-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add unboundcompute/security-agent-skills/hunting-active-directory-acl-abuse-paths@git:20260908.e3ae18aPins git:20260908.e3ae18a in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- unboundcompute/security-agent-skills
- Path
skills/hunting-active-directory-acl-abuse-paths/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260908.e3ae18a, committed Sep 8, 2026
- Size
- 10,186 bytes
- Repository stars
- 26
- License
- MIT
Hunt privilege escalation through Active Directory object permission abuse, where a low-privileged principal holds a right over a more privileged object, letting it reset a password, add itself to a group, set a delegation or logon script, write a service principal name, or take ownership and rewrite the object's permissions, chaining one granted right into control of a higher-privileged account. Use when directory object permissions may grant a standard user a write over a privileged user…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Hunting Active Directory ACL abuse paths: when one granted right owns a privileged account Every object in an Active Directory carries an access control list, and the rights on it decide who may change it. Most of those rights are mundane, but a handful hand control of the object to whoever holds them: the right to reset a password logs you in as that account, the right to write group membership adds you to a privileged group, a generic write lets you set a logon script or a delegation the account will honor, and taking ownership lets you rewrite the permissions to grant yourself anything. When one of these rights sits on a privileged object and is held by a low-privileged principal, that principal owns the object; when the object it then controls holds a right over a further object, the control chains. The bug is a right over a more privileged object held by a principal who should not control it. You hunt these by reading the permissions on privileged objects and tracing each dangerous right to the account it seizes. ## When to use - Directory object permissions may grant a standard user a write over a privileged user, group, or computer. …
Read the whole file at its exact version.
How to install
mdr add unboundcompute/security-agent-skills/hunting-active-directory-acl-abuse-paths@sha256:9a03666855c4d27bThe line at the top of this page pins the label git:20260908.e3ae18a, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_4t2ilutiubnn3k4p)
2 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Sep 8, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (10186 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
unboundcompute/security-agent-skills · 26 stars · license MIT · pushed 2026-09-08 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_4t2ilutiubnn3k4p GET https://markdownregistry.com/api/v1/resolve?ref=unboundcompute/security-agent-skills/hunting-active-directory-acl-abuse-paths GET https://markdownregistry.com/api/v1/blob/9a03666855c4d27bf0f398dba4ea97688a7d88c124e6dd351e0867f039c985c5
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.