17 tools that work with Active Directory: 0 MCP servers, 17 Agent Skills and 0 Claude Code plugins. 0 of the remote servers answered our live check, 0 worked without an API key, and 0 come from an official or verified publisher. Ranked by GitHub stars plus official, live and free-to-try signals.
Most common uses: Pentest & threat intel (14), Code & dependency scanning (3).
| Tool | Stars | Last update | License | |
|---|---|---|---|---|
| abusing-shadow-credentials-for-privesc Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-active-directory-acl-abuse Detect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and WriteOwner abuse paths SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-dcsync-attack-in-active-directory Detect DCSync attacks (MITRE T1003.006) where adversaries abuse Active Directory replication privileges to extract password hashes, by auditing Event SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-golden-ticket-attacks-in-kerberos-logs Detect Golden Ticket attacks in Active Directory using Splunk and KQL queries against domain controller event logs, looking for Kerberos TGT anomalies SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| executing-active-directory-attack-simulation Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege path SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| offensive-active-directory Active Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential a SkillInstall · skills CLI | 10,764 | MIT | ||
| active-directory-acl-abuse Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentia SkillInstall · skills CLI | 2,656 | MIT | ||
| active-directory-certificate-services AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to SkillInstall · skills CLI | 2,656 | MIT | ||
| active-directory-kerberos-attacks Kerberos attack playbook for Active Directory. Use when targeting AD authentication via AS-REP roasting, Kerberoasting, golden/silver/diamond tickets, SkillInstall · skills CLI | 2,656 | MIT | ||
| acl-abuse Abusing Active Directory object ACLs (DACL/ownership) for privilege escalation and lateral movement (GenericAll, GenericWrite, WriteDACL, WriteOwner, SkillInstall · skills CLI | 216 | MIT | ||
| ad-environment-constraints Real-world Active Directory environment constraints that silently break attacks when ignored: NTLM disabled (Kerberos fallback), AES-only KDCs (RC4 bl SkillInstall · skills CLI | 216 | MIT | ||
| ad-methodology The order of operations for an Active Directory penetration test: setup, collection, exploitation, post-processing. Use this whenever you are planning SkillInstall · skills CLI | 216 | MIT | ||
| ad-opsec-telemetry The telemetry each Active Directory technique generates and what alerts a defender: Kerberoasting produces Event 4769 with RC4 encryption (0x17) and a SkillInstall · skills CLI | 216 | MIT | ||
| adcs-attacks Active Directory Certificate Services (AD CS) escalation techniques ESC1 through ESC17, driven by hand with Certipy (ly4k). Use when the target runs a SkillInstall · skills CLI | 216 | MIT | ||
| coercion-ntlm-relay Authentication coercion (PetitPotam MS-EFSR, PrinterBug MS-RPRN, DFSCoerce MS-DFSNM) chained into NTLM relay (impacket ntlmrelayx) toward LDAP, AD CS SkillInstall · skills CLI | 216 | MIT | ||
| compliance-mapping A high-level conceptual mapping from Active Directory attack techniques to the compliance controls they touch. Kerberoasting relates to authentication SkillInstall · skills CLI | 216 | MIT | ||
| kerberos-attacks Kerberos-based Active Directory attacks driven by hand with standard tooling (Kerberoasting, AS-REP roasting, and delegation abuse: unconstrained, con SkillInstall · skills CLI | 216 | MIT |