ad-acl-abuse
Fail
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: HIGHPRIVILEGE_ESCALATIONCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [PRIVILEGE_ESCALATION]: The skill documents procedures for escalating privileges within Active Directory by abusing Access Control Entries (ACEs) like GenericAll, WriteDACL, and WriteOwner. It provides specific sequences to gain administrative control over users, groups, and computer objects.
- [COMMAND_EXECUTION]: Contains a vast array of shell commands designed to interact with domain controllers and directory services, including resetting user passwords, modifying group memberships, and reconfiguring service principal names (SPNs).
- [REMOTE_CODE_EXECUTION]: Provides instructions for lateral movement and remote task execution using tools such as impacket-psexec, impacket-wmiexec, and SharpGPOAbuse.exe, which allow an agent to run arbitrary commands on targeted domain systems.
- [DATA_EXFILTRATION]: Includes methodologies for performing DCSync attacks using impacket-secretsdump to extract NTLM hashes and other sensitive credential information from Active Directory databases.
- [EXTERNAL_DOWNLOADS]: The skill references and directs the use of numerous external offensive security tools and repositories, such as Impacket, BloodHound, and PyWhisker, which are commonly used in red teaming and penetration testing.
Recommendations
- AI detected serious security threats
Audit Metadata