Active Directory Attacks
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONCREDENTIALS_UNSAFEPERSISTENCE
Full Analysis
- [COMMAND_EXECUTION]: The skill contains numerous examples of shell and PowerShell commands for executing offensive security tools such as Impacket, BloodHound, and CrackMapExec. These are provided as part of the intended educational and operational guidance for penetration testing.
- [PRIVILEGE_ESCALATION]: Detailed instructions are included for escalating privileges to Domain Administrator through methods like Kerberoasting, AS-REP roasting, and exploiting misconfigured Active Directory Certificate Services (ADCS) templates.
- [CREDENTIALS_UNSAFE]: The documentation provides methods for harvesting domain credentials, including password spraying techniques and the extraction of NTLM hashes from Domain Controllers and service accounts.
- [PERSISTENCE]: Mechanisms for establishing and maintaining domain access, such as the creation of Kerberos Golden Tickets and the abuse of Group Policy Objects (GPOs), are clearly documented.
- [SAFE]: No unauthorized data access, hidden exfiltration, or malicious automation targeting the local host or agent environment was identified. The offensive content is consistent with the stated purpose of the skill as a guide for Active Directory security assessments.
Audit Metadata