skills/mukul975/anthropic-cybersecurity-skills/conducting-domain-persistence-with-dcsync/Gen Agent Trust Hub
conducting-domain-persistence-with-dcsync
Warn
Audited by Gen Agent Trust Hub on Apr 10, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for executing powerful offensive security tools including Mimikatz, Impacket (secretsdump.py, ticketer.py, ntlmrelayx.py), and Rubeus to perform DCSync attacks and forge Kerberos Golden Tickets.
- [COMMAND_EXECUTION]: Includes commands to modify Active Directory Access Control Lists (ACLs) using PowerShell (PowerView) to grant replication rights (DS-Replication-Get-Changes-All) to accounts, which is a technique for maintaining persistence.
- [DATA_EXFILTRATION]: Facilitates the bulk extraction of sensitive domain credentials, including the KRBTGT hash and the entire NTDS database, which allows for the compromise of all identities within an Active Directory domain.
- [SAFE]: The provided Python scripts (
scripts/agent.pyandscripts/process.py) are focused on auditing and analysis, such as identifying accounts with replication rights and parsing dumped hash files locally. - [SAFE]: Dependencies are limited to well-known and reputable security libraries such as
ldap3,impacket, andpyad.
Audit Metadata