ADScanPro/Claude-AD

AD CS Attacks covers Active Directory Certificate Services escalation paths ESC1 through ESC17 using Certipy. Use it to enumerate vulnerable templates or CA settings, request impersonation certificates, and review checks, event IDs, and remediation.

AD Environment Constraints lists common Active Directory hardening checks that break NTLM, Kerberos, LDAP, and SMB operations. Use it to fingerprint domain posture and choose the right auth path, transport, and host naming before running AD tools.

AD Methodology gives the phase order for an Active Directory assessment: setup, collection, exploitation, and post-processing. Use it to decide what to run next, avoid lockouts, and collect the right data before attacking.

AD OPSEC Telemetry explains the Windows events and defender alerts generated by common Active Directory techniques like Kerberoasting, AS-REP roasting, DCSync, LSASS dumping, and lateral movement. Use it to document engagement noise or to decide what to monitor.

Acl Abuse turns dangerous Active Directory ACLs and ownership rights into exact bloodyAD and impacket commands for privilege escalation, lateral movement, and DCSync after compromise. Use it when BloodHound CE shows an outbound control edge such as GenericAll, WriteDACL, or AddMember.

Coercion And NTLM Relay forces a privileged Windows account to authenticate outward, then relays NTLM to LDAP, SMB, or AD CS web enrollment. Use it for RBCD, DCSync-capable ACL writes, certificates, detection, and hardening checks.

Compliance Mapping provides a conceptual map from Active Directory attack techniques to related compliance control families. Use it to orient a technical finding toward ENS, NIS2, or DORA without treating it as an auditor-grade control matrix.

Kerberos Attacks covers Kerberoasting, AS-REP roasting, and delegation abuse in Active Directory using standard tools. Use it when you need commands, hash formats, event IDs, and remediation for Kerberos-based attack paths.