zebbern/claude-code-guide · skills/active-directory-attacks/SKILL.md
active-directory-attacks skillA
This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", "Silver Ticket", "AS-REP roasting", "NTLM relay", or needs guidance on Windows domain penetration testing.
Latest version
mdr add zebbern/claude-code-guide/active-directory-attacks@v1.1Exact content
mdr add zebbern/claude-code-guide/active-directory-attacks@sha256:a086e99cb5f9a45fBadge
[](https://markdownregistry.com/a/art_dvmzpf7bz3xzamdo)
0 badge views in 30 days
Versions
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| v1.1 latest | 2026-05-31 | 164971d | 9,504 B | A | view · diff |
| v1.1 | 2026-01-20 | 27bf883 | 9,504 B | A | view · diff |
| git:20260104.9174e17 | 2026-01-04 | 9174e17 | 9,459 B | A | view |
Audit of the latest version
A 17 of 17 checks passed. Deterministic, no model, same answer every run.
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (9504 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
GitHub
zebbern/claude-code-guide · 4,603 stars · license MIT · pushed 2026-09-05 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_dvmzpf7bz3xzamdo GET https://markdownregistry.com/api/v1/resolve?ref=zebbern/claude-code-guide/active-directory-attacks GET https://markdownregistry.com/api/v1/blob/a086e99cb5f9a45f9499a465800189739acd65c555559960af52cdd2c3fcc61e