What it does. Assess Active Directory security posture using PingCastle, BloodHound, Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/performing-active-directory-vulnerability-assessment/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-active-directory-vulnerability-assessment, or copy the skill folder into ~/.claude/skills/performing-active-directory-vulnerability-assessment/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-active-directory-vulnerability-assessment/SKILL.md

SKILL.md (verbatim)

name: performing-active-directory-vulnerability-assessment
description: Assess Active Directory security posture using PingCastle, BloodHound,
  and Purple Knight to identify misconfigurations, privilege escalation paths, and
  attack vectors.
domain: cybersecurity
subdomain: vulnerability-management
tags:
- active-directory
- pingcastle
- bloodhound
- purple-knight
- ad-security
- privilege-escalation
- ldap
- kerberos
version: '1.0'
author: mahipal
license: Apache-2.0
d3fend_techniques:
- Restore Object
- Network Traffic Policy Mapping
- Restore Configuration
- Access Modeling
- Operational Activity Mapping
nist_csf:
- ID.RA-01
- ID.RA-02
- ID.IM-02
- ID.RA-06
mitre_attack:
- T1190
- T1203
- T1068
- T1548
- T1134

Performing Active Directory Vulnerability Assessment

Overview

Active Directory (AD) is the primary identity and access management system in most enterprise environments, making it a critical attack target. This skill covers comprehensive AD security assessment using PingCastle for health checks, BloodHound for attack path analysis, and Purple Knight for security posture scoring. These tools identify misconfigurations, excessive privileges, Kerberos weaknesses, and lateral movement opportunities.

When to Use

• When conducting security assessments that involve performing active directory vulnerability assessment
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Domain-joined workstation or domain admin access for scanning
• PingCastle (https://github.com/netwrix/pingcastle)
• BloodHound Community Edition with SharpHound collector
• Purple Knight from Semperis (free community tool)
• Python 3.9+ for analysis scripts
• .NET Framework 4.7+ for PingCastle on Windows

Tool 1: PingCastle Health Check

Installation and Execution

# Download PingCastle
Invoke-WebRequest -Uri "https://github.com/netwrix/pingcastle/releases/latest/download/PingCastle.zip" `
  -OutFile "PingCastle.zip"
Expand-Archive PingCastle.zip -DestinationPath C:\Tools\PingCastle

# Run health check against current domain
cd C:\Tools\PingCastle
.\PingCastle.exe --healthcheck

# Run health check against specific domain
.\PingCastle.exe --healthcheck --server dc01.corp.local --user CORP\scanner_account --password P@ssw0rd

# Run in scanner mode for multiple domains
.\PingCastle.exe --scanner --scannerlp

# Generate consolidated report
.\PingCastle.exe --healthcheck --level Full

PingCastle Scoring Categories

Category	Description	Risk Areas
Stale Objects	Inactive accounts, old passwords, obsolete OS	Ghost accounts, expired credentials
Privileged Accounts	Excessive admin rights, nested groups	Domain Admin sprawl, SID history
Trusts	Forest and domain trust configurations	Transitive trust abuse, SID filtering
Anomalies	Security setting deviations	GPO misconfigurations, schema issues

Key PingCastle Checks

# Critical items to review in PingCastle report:
- Accounts with "Password Never Expires" flag
- Accounts with Kerberos pre-authentication disabled (AS-REP roastable)
- Accounts with Kerberos delegation (unconstrained/constrained)
- Domain Controllers running unsupported OS versions
- AdminSDHolder permission modifications
- Accounts in privileged groups (Domain Admins, Enterprise Admins, Schema Admins)
- Trust relationships with SID filtering disabled
- GPO vulnerabilities allowing privilege escalation

Tool 2: BloodHound Attack Path Analysis

SharpHound Data Collection

# Download SharpHound collector
# https://github.com/SpecterOps/BloodHound/tree/main/packages/csharp/SharpHound

# Run SharpHound collection (all methods)
.\SharpHound.exe --collectionmethods All --domain corp.local --zipfilename bloodhound_data.zip

# Stealthy collection (minimal noise)
.\SharpHound.exe --collectionmethods Session,LoggedOn --domain corp.local --stealth

# Collection with specific domain controller
.\SharpHound.exe --collectionmethods All --domain corp.local --domaincontroller dc01.corp.local

# Run via PowerShell
Import-Module .\SharpHound.ps1
Invoke-BloodHound -CollectionMethod All -Domain corp.local -OutputDirectory C:\BH_Data

BloodHound CE Setup

# Deploy BloodHound Community Edition with Docker
curl -L https://ghst.ly/getbhce -o docker-compose.yml
docker compose up -d

# Access BloodHound CE at http://localhost:8080
# Default credentials shown in docker compose logs

# Upload SharpHound data through web UI or API
curl -X POST "http://localhost:8080/api/v2/file-upload/start" \
  -H "Authorization: Bearer $BH_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"fileName": "bloodhound_data.zip"}'

Critical BloodHound Queries

# Find shortest path to Domain Admin
MATCH p=shortestPath((u:User)-[*1..]->(g:Group {name:"DOMAIN ADMINS@CORP.LOCAL"}))
WHERE u.name <> "ADMINISTRATOR@CORP.LOCAL"
RETURN p

# Find Kerberoastable accounts with admin privileges
MATCH (u:User {hasspn:true})-[:MemberOf*1..]->(g:Group)
WHERE g.name CONTAINS "ADMIN"
RETURN u.name, u.serviceprincipalnames

# Find computers where Domain Admins are logged in
MATCH (c:Computer)-[:HasSession]->(u:User)-[:MemberOf*1..]->(g:Group {name:"DOMAIN ADMINS@CORP.LOCAL"})
RETURN c.name, u.name

# Find AS-REP roastable accounts
MATCH (u:User {dontreqpreauth:true})
RETURN u.name, u.description

# Find unconstrained delegation hosts
MATCH (c:Computer {unconstraineddelegation:true})
WHERE NOT c.name CONTAINS "DC"
RETURN c.name

# Find GPO abuse paths
MATCH p=(u:User)-[:GenericAll|GenericWrite|WriteOwner|WriteDacl]->(g:GPO)
RETURN p

Tool 3: Purple Knight Assessment

# Download Purple Knight from https://www.purple-knight.com/
# Run as domain admin or with appropriate read permissions

.\PurpleKnight.exe

# Purple Knight checks 130+ security indicators across:
# - Account Security (password policies, privileged accounts)
# - AD Infrastructure (replication, DNS, LDAP signing)
# - Group Policy (GPO permissions, security settings)
# - Kerberos Security (delegation, encryption types, SPN)
# - AD Delegation (AdminSDHolder, OU permissions)

Purple Knight Score Categories

Score Range	Rating	Action Required
90-100	Excellent	Maintain current posture
75-89	Good	Address high-risk findings
60-74	Fair	Prioritize remediation plan
40-59	Poor	Immediate remediation required
0-39	Critical	Emergency response needed

Common AD Vulnerabilities

1. Kerberoasting Exposure

# Find SPNs assigned to user accounts (Kerberoasting targets)
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName |
  Select-Object Name, ServicePrincipalName, PasswordLastSet, Enabled

2. AS-REP Roasting Exposure

# Find accounts with pre-auth disabled
Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true} -Properties DoesNotRequirePreAuth |
  Select-Object Name, DoesNotRequirePreAuth, Enabled

3. LLMNR/NBT-NS Poisoning Risk

# Check if LLMNR is disabled via GPO
Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" -Name EnableMulticast -ErrorAction SilentlyContinue

4. Excessive Privileged Group Membership

# Count members in critical groups
$groups = @("Domain Admins", "Enterprise Admins", "Schema Admins", "Account Operators", "Backup Operators")
foreach ($group in $groups) {
    $count = (Get-ADGroupMember -Identity $group -Recursive).Count
    Write-Output "$group : $count members"
}

Remediation Priorities

Finding	Risk	Remediation
Kerberoastable admin accounts	Critical	Remove SPNs or use MSA/gMSA
Unconstrained delegation on non-DCs	Critical	Switch to constrained/RBCD
Password Never Expires on admins	High	Enable password rotation policy
AS-REP roastable accounts	High	Enable Kerberos pre-authentication
AdminSDHolder modification	High	Audit and restore default ACLs
Stale computer accounts (90+ days)	Medium	Disable and move to quarantine OU
LDAP signing not enforced	Medium	Enable via GPO on all DCs

References

• PingCastle GitHub
• BloodHound CE
• Purple Knight
• MITRE ATT&CK - Active Directory
• Microsoft AD Security Best Practices

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Active Directory Security Assessment Checklist

Pre-Assessment Preparation

• Obtain written authorization for AD security assessment
• Identify domain controllers and AD forest/domain topology
• Create dedicated scan account with Domain Admin read access
• Document assessment scope (domains, OUs, forests)
• Schedule assessment during maintenance window if using active scanning

PingCastle Assessment

• Run PingCastle --healthcheck against all in-scope domains
• Review overall score and category breakdown
• Document all findings with points >= 10
• Export report as XML for automated processing
• Check trust relationship security
• Verify AdminSDHolder integrity

BloodHound Assessment

• Deploy SharpHound collector
• Run full collection (All methods)
• Upload data to BloodHound CE
• Run shortest path to Domain Admin queries
• Identify Kerberoastable admin accounts
• Map unconstrained delegation hosts
• Check for AS-REP roastable accounts
• Analyze GPO abuse paths
• Document all attack paths with 3 or fewer hops

Purple Knight Assessment

• Run Purple Knight community edition
• Review score across all five categories
• Document indicators below 75% score threshold

Critical Findings Checklist

Kerberos Security

• No user accounts with SPNs in admin groups (Kerberoasting)
• Kerberos pre-authentication enabled for all accounts
• No unconstrained delegation on non-DC computers
• AES-256 encryption enabled; RC4 and DES disabled
• Kerberos ticket lifetime <= 10 hours

Privileged Accounts

• Domain Admins group has <= 5 members
• Enterprise Admins group has <= 3 members
• Schema Admins group is empty (only populated during schema changes)
• All admin accounts have password expiration enabled
• Protected Users group configured for Tier 0 accounts
• Tiered admin model implemented (Tier 0/1/2)

Password Policy

• Minimum password length >= 14 characters
• Password history >= 24 passwords
• Account lockout threshold set (10-15 attempts)
• Fine-grained password policy for admin accounts (25+ chars)

Infrastructure Security

• LDAP signing required on all domain controllers
• LDAP channel binding set to Required
• SMB signing required on DCs
• NTLMv2 only (LM and NTLMv1 disabled)
• All DCs running supported OS versions
• LAPS deployed for local admin passwords

references/api-reference.md (verbatim)

Active Directory Vulnerability Assessment - API Reference

PingCastle XML Report

PingCastle generates XML health check reports with scoring across four categories:

Category	Description
StaleObjects	Dormant accounts, old computer objects, unused groups
PrivilegiedGroup	Excessive admin memberships, unprotected privileged accounts
Trust	Insecure trust relationships, SID filtering
Anomaly	Unusual configurations, legacy protocols

Score Interpretation

• 0-20: Excellent
• 21-50: Good
• 51-75: Needs improvement
• 76-100: Critical

XML Structure

<HealthcheckData>
  <GlobalScore>45</GlobalScore>
  <StaleObjectsScore>15</StaleObjectsScore>
  <PrivilegiedGroupScore>20</PrivilegiedGroupScore>
  <RiskRules>
    <HealthcheckRiskRule>
      <RiskId>P-AdminCount</RiskId>
      <Category>PrivilegiedGroup</Category>
      <Points>30</Points>
      <Rationale>15 accounts with adminCount=1</Rationale>
    </HealthcheckRiskRule>
  </RiskRules>
</HealthcheckData>

LDAP Checks (ldap3)

Password Policy Attributes

Attribute	Type	Description
minPwdLength	int	Minimum password length
lockoutThreshold	int	Failed attempts before lockout (0 = disabled)
pwdHistoryLength	int	Number of remembered passwords
maxPwdAge	interval	Maximum password age

krbtgt Account

The krbtgt account key encrypts all Kerberos tickets. If compromised (Golden Ticket attack), all tickets must be invalidated by resetting krbtgt password twice. Recommended rotation: every 180 days.

conn.search(base_dn, "(&(objectClass=user)(sAMAccountName=krbtgt))",
            attributes=["pwdLastSet"])

Vulnerability Categories

Critical

• No account lockout policy
• krbtgt password > 180 days old
• PingCastle risk rules with 50+ points

High

• Minimum password length < 12
• Accounts with adminCount=1 not in privileged groups
• Legacy protocols enabled (NTLMv1, LM hashes)

Medium

• Password history < 12
• Stale computer objects > 90 days
• Unconstrained delegation

Output Schema

{
  "report": "ad_vulnerability_assessment",
  "pingcastle_scores": {"global": 45, "staleobjects": 15},
  "total_findings": 20,
  "severity_summary": {"critical": 3, "high": 10, "medium": 7}
}

CLI Usage

python agent.py --pingcastle-xml report.xml --server ldaps://dc.example.com --username "DOMAIN\\user" --password "pass" --output report.json

references/standards.md (verbatim)

Standards and References - AD Vulnerability Assessment

Primary Standards

MITRE ATT&CK - Active Directory Techniques

• URL: https://attack.mitre.org/
• Key Techniques:
  • T1558.003 - Kerberoasting
  • T1558.004 - AS-REP Roasting
  • T1557.001 - LLMNR/NBT-NS Poisoning
  • T1484.001 - Group Policy Modification
  • T1134.005 - SID-History Injection
  • T1003.006 - DCSync

CIS Benchmark for Active Directory

• URL: https://www.cisecurity.org/benchmark/active_directory
• Relevance: Provides prescriptive hardening guidance for AD configuration

Microsoft Security Compliance Toolkit

• URL: https://www.microsoft.com/en-us/download/details.aspx?id=55319
• Relevance: Baseline GPO settings for domain controllers and member servers

NIST SP 800-63B

• Title: Digital Identity Guidelines - Authentication and Lifecycle Management
• URL: https://pages.nist.gov/800-63-3/sp800-63b.html
• Relevance: Password policy requirements applicable to AD accounts

NSA Active Directory Security Guidance

• Title: Detecting and Preventing Active Directory Attacks
• Relevance: NSA recommendations for securing AD against common attack techniques

Tools

Tool	License	URL
PingCastle	Open Source (Netwrix)	https://github.com/netwrix/pingcastle
BloodHound CE	Apache 2.0	https://github.com/SpecterOps/BloodHound
SharpHound	Apache 2.0	https://github.com/SpecterOps/BloodHound
Purple Knight	Free Community	https://www.purple-knight.com/
ADRecon	MIT	https://github.com/adrecon/ADRecon
Testimo	MIT	https://github.com/EvotecIT/Testimo

references/workflows.md (verbatim)

Workflows - AD Vulnerability Assessment

Workflow 1: Comprehensive AD Security Assessment

Steps

1. Run PingCastle health check to get overall AD security score
2. Review PingCastle report for stale objects, privilege issues, trust problems, and anomalies
3. Run SharpHound data collection against the domain
4. Upload SharpHound data to BloodHound CE
5. Execute critical BloodHound queries (shortest path to DA, Kerberoastable admins, delegation issues)
6. Run Purple Knight for additional security indicator checks
7. Consolidate findings from all three tools into unified report
8. Prioritize findings by risk severity and attack path impact
9. Generate remediation plan with specific PowerShell/GPO fix commands

Workflow 2: Attack Path Remediation

Steps

1. Identify top 5 shortest attack paths to Domain Admin from BloodHound
2. For each path, determine the weakest link (misconfigured ACL, session reuse, etc.)
3. Remediate weakest links to break attack paths
4. Re-run BloodHound collection to verify paths are eliminated
5. Document remediated paths and remaining risk

Workflow 3: Privileged Account Hardening

Steps

1. Export all members of privileged groups from PingCastle report
2. Validate each account has legitimate business need for privilege
3. Remove unnecessary privileged group memberships
4. Implement tiered administration model (Tier 0/1/2)
5. Enable Protected Users group for sensitive accounts
6. Configure AdminSDHolder with correct ACLs
7. Verify changes with follow-up PingCastle scan

Workflow 4: Kerberos Security Hardening

Steps

1. Identify all Kerberoastable accounts from BloodHound
2. Convert user-assigned SPNs to Managed Service Accounts (MSA/gMSA) where possible
3. For remaining SPNs, ensure 25+ character passwords with rotation
4. Disable DES and RC4 encryption for Kerberos
5. Enable AES-256 encryption for all accounts
6. Enable Kerberos pre-authentication for all accounts
7. Configure constrained delegation to replace unconstrained delegation

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.