ADScanPro/Claude-AD

139 stars · Last commit 2026-08-24

Active Directory pentest methodology for Claude Code: skills, agents and slash commands for internal AD red-team work (Kerberoasting, ADCS ESC1-17, DCSync, ACL abuse, NTLM relay, delegation), with per-technique OPSEC/telemetry notes. Drives netexec, impacket, certipy, bloodyAD, BloodHound CE.

README preview

<div align="center">

# Claude-AD

**Active Directory pentest methodology for Claude Code.**

[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
[![Claude Code plugin](https://img.shields.io/badge/Claude%20Code-plugin-8A2BE2)](https://docs.anthropic.com/en/docs/claude-code)
[![Version](https://img.shields.io/badge/version-0.1.0-informational)](.claude-plugin/plugin.json)
[![Techniques](https://img.shields.io/badge/techniques-Kerberoast%20%C2%B7%20ADCS%20ESC1--17%20%C2%B7%20DCSync%20%C2%B7%20NTLM%20relay-critical)](#what-this-is)

Skills, agents and commands that give Claude the playbook for an internal Active Directory assessment: the phase order, the environment constraints that break your tooling, the telemetry each technique leaves behind, and how a finding maps to a compliance control. It drives standard tooling (netexec, impacket, certipy, bloodyAD, BloodHound CE). You still run the engagement; Claude carries the method.

</div>

---

## What this is

Every AD assessment follows the same spine: map before you exploit, harvest the easy credentials before you spray, collect the graph before you reason about paths. That spine, plus the hundred small constraints a hardened domain throws at you (NTLM disabled, AES-only Kerberos, LDAP channel binding, SPNs that must be FQDNs), is what separates an operator who finishes the engagement from one who spends a day debugging `invalidCredentials`.

View full repository on GitHub →