exploiting-active-directory-with-bloodhound

SUSPICIOUS/HIGH-RISK: the skill is internally consistent as a red-team BloodHound guide, but its purpose is to enable offensive AD exploitation by an AI agent. Official SpecterOps tooling reduces pure supply-chain concern, yet the skill still instructs transfer to compromised hosts, exfiltration of collected data, and references third-party tools without strong provenance controls.

No clear malicious payload, persistence mechanism, credential theft, exfiltration, cryptomining, or obfuscation is present. The code is a dual-use Active Directory reconnaissance and BloodHound analysis utility. It presents meaningful operational security risks because it executes external enumeration tools, exposes passwords through command-line arguments, includes a hardcoded default Neo4j credential, accepts unrestricted Cypher queries, and reads/writes user-controlled paths. Use only in authorized environments and replace default credentials with secure configuration.

The fragment is offensive Active Directory tradecraft documentation. It enables broad directory reconnaissance and provides concrete procedures for credential theft, lateral movement, privilege escalation, GPO abuse, and domain compromise. It does not itself contain an embedded malware payload or automatic exfiltration mechanism, but execution in an unauthorized environment could cause severe compromise. Use only with explicit authorization, isolate test credentials, verify downloaded tooling, and avoid storing real passwords or hashes in commands or documentation.