[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFKBG67RV8JD73V8B9FW6V":3,"skill-same:01M6AFKBG67RV8JD73V8B9FW6V":120},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":36,"linkOnly":37,"markdownContent":38,"markdownBody":39,"frontMatter":40,"refName":61,"commitSha":62,"skillDirectory":63,"forksCount":64,"repositoryHtmlUrl":65,"repositoryHomepageUrl":66,"ownerHtmlUrl":67,"ownerBlogUrl":68,"ownerDescription":69,"updatedAt":70,"install":71,"resources":84},"01M6AFKBG67RV8JD73V8B9FW6V","performing-active-directory-vulnerability-assessment",null,"Assess Active Directory security posture using PingCastle, BloodHound, and Purple Knight to identify misconfigurations, privilege escalation paths, and attack vectors.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-vulnerability-assessment\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35],"performing active directory vulnerability assessment","assessment","directory","network","ad-security","purple-knight","pingcastle","kerberos","bloodhound","vulnerability-management","escalation","ldap","privilege-escalation","active-directory","cybersecurity","policy","security","2026-11-10 10:12:30",false,"---\nname: performing-active-directory-vulnerability-assessment\ndescription: Assess Active Directory security posture using PingCastle, BloodHound,\n  and Purple Knight to identify misconfigurations, privilege escalation paths, and\n  attack vectors.\ndomain: cybersecurity\nsubdomain: vulnerability-management\ntags:\n- active-directory\n- pingcastle\n- bloodhound\n- purple-knight\n- ad-security\n- privilege-escalation\n- ldap\n- kerberos\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Restore Object\n- Network Traffic Policy Mapping\n- Restore Configuration\n- Access Modeling\n- Operational Activity Mapping\nnist_csf:\n- ID.RA-01\n- ID.RA-02\n- ID.IM-02\n- ID.RA-06\nmitre_attack:\n- T1190\n- T1203\n- T1068\n- T1548\n- T1134\n---\n\n# Performing Active Directory Vulnerability Assessment\n\n## Overview\n\nActive Directory (AD) is the primary identity and access management system in most enterprise environments, making it a critical attack target. This skill covers comprehensive AD security assessment using PingCastle for health checks, BloodHound for attack path analysis, and Purple Knight for security posture scoring. These tools identify misconfigurations, excessive privileges, Kerberos weaknesses, and lateral movement opportunities.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing active directory vulnerability assessment\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Domain-joined workstation or domain admin access for scanning\n- PingCastle (https:\u002F\u002Fgithub.com\u002Fnetwrix\u002Fpingcastle)\n- BloodHound Community Edition with SharpHound collector\n- Purple Knight from Semperis (free community tool)\n- Python 3.9+ for analysis scripts\n- .NET Framework 4.7+ for PingCastle on Windows\n\n## Tool 1: PingCastle Health Check\n\n### Installation and Execution\n```powershell\n# Download PingCastle\nInvoke-WebRequest -Uri \"https:\u002F\u002Fgithub.com\u002Fnetwrix\u002Fpingcastle\u002Freleases\u002Flatest\u002Fdownload\u002FPingCastle.zip\" `\n  -OutFile \"PingCastle.zip\"\nExpand-Archive PingCastle.zip -DestinationPath C:\\Tools\\PingCastle\n\n# Run health check against current domain\ncd C:\\Tools\\PingCastle\n.\\PingCastle.exe --healthcheck\n\n# Run health check against specific domain\n.\\PingCastle.exe --healthcheck --server dc01.corp.local --user CORP\\scanner_account --password P@ssw0rd\n\n# Run in scanner mode for multiple domains\n.\\PingCastle.exe --scanner --scannerlp\n\n# Generate consolidated report\n.\\PingCastle.exe --healthcheck --level Full\n```\n\n### PingCastle Scoring Categories\n\n| Category | Description | Risk Areas |\n|----------|------------|------------|\n| **Stale Objects** | Inactive accounts, old passwords, obsolete OS | Ghost accounts, expired credentials |\n| **Privileged Accounts** | Excessive admin rights, nested groups | Domain Admin sprawl, SID history |\n| **Trusts** | Forest and domain trust configurations | Transitive trust abuse, SID filtering |\n| **Anomalies** | Security setting deviations | GPO misconfigurations, schema issues |\n\n### Key PingCastle Checks\n```\n# Critical items to review in PingCastle report:\n- Accounts with \"Password Never Expires\" flag\n- Accounts with Kerberos pre-authentication disabled (AS-REP roastable)\n- Accounts with Kerberos delegation (unconstrained\u002Fconstrained)\n- Domain Controllers running unsupported OS versions\n- AdminSDHolder permission modifications\n- Accounts in privileged groups (Domain Admins, Enterprise Admins, Schema Admins)\n- Trust relationships with SID filtering disabled\n- GPO vulnerabilities allowing privilege escalation\n```\n\n## Tool 2: BloodHound Attack Path Analysis\n\n### SharpHound Data Collection\n```powershell\n# Download SharpHound collector\n# https:\u002F\u002Fgithub.com\u002FSpecterOps\u002FBloodHound\u002Ftree\u002Fmain\u002Fpackages\u002Fcsharp\u002FSharpHound\n\n# Run SharpHound collection (all methods)\n.\\SharpHound.exe --collectionmethods All --domain corp.local --zipfilename bloodhound_data.zip\n\n# Stealthy collection (minimal noise)\n.\\SharpHound.exe --collectionmethods Session,LoggedOn --domain corp.local --stealth\n\n# Collection with specific domain controller\n.\\SharpHound.exe --collectionmethods All --domain corp.local --domaincontroller dc01.corp.local\n\n# Run via PowerShell\nImport-Module .\\SharpHound.ps1\nInvoke-BloodHound -CollectionMethod All -Domain corp.local -OutputDirectory C:\\BH_Data\n```\n\n### BloodHound CE Setup\n```bash\n# Deploy BloodHound Community Edition with Docker\ncurl -L https:\u002F\u002Fghst.ly\u002Fgetbhce -o docker-compose.yml\ndocker compose up -d\n\n# Access BloodHound CE at http:\u002F\u002Flocalhost:8080\n# Default credentials shown in docker compose logs\n\n# Upload SharpHound data through web UI or API\ncurl -X POST \"http:\u002F\u002Flocalhost:8080\u002Fapi\u002Fv2\u002Ffile-upload\u002Fstart\" \\\n  -H \"Authorization: Bearer $BH_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"fileName\": \"bloodhound_data.zip\"}'\n```\n\n### Critical BloodHound Queries\n```cypher\n# Find shortest path to Domain Admin\nMATCH p=shortestPath((u:User)-[*1..]->(g:Group {name:\"DOMAIN ADMINS@CORP.LOCAL\"}))\nWHERE u.name \u003C> \"ADMINISTRATOR@CORP.LOCAL\"\nRETURN p\n\n# Find Kerberoastable accounts with admin privileges\nMATCH (u:User {hasspn:true})-[:MemberOf*1..]->(g:Group)\nWHERE g.name CONTAINS \"ADMIN\"\nRETURN u.name, u.serviceprincipalnames\n\n# Find computers where Domain Admins are logged in\nMATCH (c:Computer)-[:HasSession]->(u:User)-[:MemberOf*1..]->(g:Group {name:\"DOMAIN ADMINS@CORP.LOCAL\"})\nRETURN c.name, u.name\n\n# Find AS-REP roastable accounts\nMATCH (u:User {dontreqpreauth:true})\nRETURN u.name, u.description\n\n# Find unconstrained delegation hosts\nMATCH (c:Computer {unconstraineddelegation:true})\nWHERE NOT c.name CONTAINS \"DC\"\nRETURN c.name\n\n# Find GPO abuse paths\nMATCH p=(u:User)-[:GenericAll|GenericWrite|WriteOwner|WriteDacl]->(g:GPO)\nRETURN p\n```\n\n## Tool 3: Purple Knight Assessment\n\n```powershell\n# Download Purple Knight from https:\u002F\u002Fwww.purple-knight.com\u002F\n# Run as domain admin or with appropriate read permissions\n\n.\\PurpleKnight.exe\n\n# Purple Knight checks 130+ security indicators across:\n# - Account Security (password policies, privileged accounts)\n# - AD Infrastructure (replication, DNS, LDAP signing)\n# - Group Policy (GPO permissions, security settings)\n# - Kerberos Security (delegation, encryption types, SPN)\n# - AD Delegation (AdminSDHolder, OU permissions)\n```\n\n### Purple Knight Score Categories\n| Score Range | Rating | Action Required |\n|------------|--------|----------------|\n| 90-100 | Excellent | Maintain current posture |\n| 75-89 | Good | Address high-risk findings |\n| 60-74 | Fair | Prioritize remediation plan |\n| 40-59 | Poor | Immediate remediation required |\n| 0-39 | Critical | Emergency response needed |\n\n## Common AD Vulnerabilities\n\n### 1. Kerberoasting Exposure\n```powershell\n# Find SPNs assigned to user accounts (Kerberoasting targets)\nGet-ADUser -Filter {ServicePrincipalName -ne \"$null\"} -Properties ServicePrincipalName |\n  Select-Object Name, ServicePrincipalName, PasswordLastSet, Enabled\n```\n\n### 2. AS-REP Roasting Exposure\n```powershell\n# Find accounts with pre-auth disabled\nGet-ADUser -Filter {DoesNotRequirePreAuth -eq $true} -Properties DoesNotRequirePreAuth |\n  Select-Object Name, DoesNotRequirePreAuth, Enabled\n```\n\n### 3. LLMNR\u002FNBT-NS Poisoning Risk\n```powershell\n# Check if LLMNR is disabled via GPO\nGet-ItemProperty \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\DNSClient\" -Name EnableMulticast -ErrorAction SilentlyContinue\n```\n\n### 4. Excessive Privileged Group Membership\n```powershell\n# Count members in critical groups\n$groups = @(\"Domain Admins\", \"Enterprise Admins\", \"Schema Admins\", \"Account Operators\", \"Backup Operators\")\nforeach ($group in $groups) {\n    $count = (Get-ADGroupMember -Identity $group -Recursive).Count\n    Write-Output \"$group : $count members\"\n}\n```\n\n## Remediation Priorities\n\n| Finding | Risk | Remediation |\n|---------|------|-------------|\n| Kerberoastable admin accounts | Critical | Remove SPNs or use MSA\u002FgMSA |\n| Unconstrained delegation on non-DCs | Critical | Switch to constrained\u002FRBCD |\n| Password Never Expires on admins | High | Enable password rotation policy |\n| AS-REP roastable accounts | High | Enable Kerberos pre-authentication |\n| AdminSDHolder modification | High | Audit and restore default ACLs |\n| Stale computer accounts (90+ days) | Medium | Disable and move to quarantine OU |\n| LDAP signing not enforced | Medium | Enable via GPO on all DCs |\n\n## References\n\n- [PingCastle GitHub](https:\u002F\u002Fgithub.com\u002Fnetwrix\u002Fpingcastle)\n- [BloodHound CE](https:\u002F\u002Fgithub.com\u002FSpecterOps\u002FBloodHound)\n- [Purple Knight](https:\u002F\u002Fwww.purple-knight.com\u002F)\n- [MITRE ATT&CK - Active Directory](https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1484\u002F)\n- [Microsoft AD Security Best Practices](https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows-server\u002Fidentity\u002Fad-ds\u002Fplan\u002Fsecurity-best-practices\u002Fbest-practices-for-securing-active-directory)\n","# Performing Active Directory Vulnerability Assessment\n\n## Overview\n\nActive Directory (AD) is the primary identity and access management system in most enterprise environments, making it a critical attack target. This skill covers comprehensive AD security assessment using PingCastle for health checks, BloodHound for attack path analysis, and Purple Knight for security posture scoring. These tools identify misconfigurations, excessive privileges, Kerberos weaknesses, and lateral movement opportunities.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing active directory vulnerability assessment\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Domain-joined workstation or domain admin access for scanning\n- PingCastle (https:\u002F\u002Fgithub.com\u002Fnetwrix\u002Fpingcastle)\n- BloodHound Community Edition with SharpHound collector\n- Purple Knight from Semperis (free community tool)\n- Python 3.9+ for analysis scripts\n- .NET Framework 4.7+ for PingCastle on Windows\n\n## Tool 1: PingCastle Health Check\n\n### Installation and Execution\n```powershell\n# Download PingCastle\nInvoke-WebRequest -Uri \"https:\u002F\u002Fgithub.com\u002Fnetwrix\u002Fpingcastle\u002Freleases\u002Flatest\u002Fdownload\u002FPingCastle.zip\" `\n  -OutFile \"PingCastle.zip\"\nExpand-Archive PingCastle.zip -DestinationPath C:\\Tools\\PingCastle\n\n# Run health check against current domain\ncd C:\\Tools\\PingCastle\n.\\PingCastle.exe --healthcheck\n\n# Run health check against specific domain\n.\\PingCastle.exe --healthcheck --server dc01.corp.local --user CORP\\scanner_account --password P@ssw0rd\n\n# Run in scanner mode for multiple domains\n.\\PingCastle.exe --scanner --scannerlp\n\n# Generate consolidated report\n.\\PingCastle.exe --healthcheck --level Full\n```\n\n### PingCastle Scoring Categories\n\n| Category | Description | Risk Areas |\n|----------|------------|------------|\n| **Stale Objects** | Inactive accounts, old passwords, obsolete OS | Ghost accounts, expired credentials |\n| **Privileged Accounts** | Excessive admin rights, nested groups | Domain Admin sprawl, SID history |\n| **Trusts** | Forest and domain trust configurations | Transitive trust abuse, SID filtering |\n| **Anomalies** | Security setting deviations | GPO misconfigurations, schema issues |\n\n### Key PingCastle Checks\n```\n# Critical items to review in PingCastle report:\n- Accounts with \"Password Never Expires\" flag\n- Accounts with Kerberos pre-authentication disabled (AS-REP roastable)\n- Accounts with Kerberos delegation (unconstrained\u002Fconstrained)\n- Domain Controllers running unsupported OS versions\n- AdminSDHolder permission modifications\n- Accounts in privileged groups (Domain Admins, Enterprise Admins, Schema Admins)\n- Trust relationships with SID filtering disabled\n- GPO vulnerabilities allowing privilege escalation\n```\n\n## Tool 2: BloodHound Attack Path Analysis\n\n### SharpHound Data Collection\n```powershell\n# Download SharpHound collector\n# https:\u002F\u002Fgithub.com\u002FSpecterOps\u002FBloodHound\u002Ftree\u002Fmain\u002Fpackages\u002Fcsharp\u002FSharpHound\n\n# Run SharpHound collection (all methods)\n.\\SharpHound.exe --collectionmethods All --domain corp.local --zipfilename bloodhound_data.zip\n\n# Stealthy collection (minimal noise)\n.\\SharpHound.exe --collectionmethods Session,LoggedOn --domain corp.local --stealth\n\n# Collection with specific domain controller\n.\\SharpHound.exe --collectionmethods All --domain corp.local --domaincontroller dc01.corp.local\n\n# Run via PowerShell\nImport-Module .\\SharpHound.ps1\nInvoke-BloodHound -CollectionMethod All -Domain corp.local -OutputDirectory C:\\BH_Data\n```\n\n### BloodHound CE Setup\n```bash\n# Deploy BloodHound Community Edition with Docker\ncurl -L https:\u002F\u002Fghst.ly\u002Fgetbhce -o docker-compose.yml\ndocker compose up -d\n\n# Access BloodHound CE at http:\u002F\u002Flocalhost:8080\n# Default credentials shown in docker compose logs\n\n# Upload SharpHound data through web UI or API\ncurl -X POST \"http:\u002F\u002Flocalhost:8080\u002Fapi\u002Fv2\u002Ffile-upload\u002Fstart\" \\\n  -H \"Authorization: Bearer $BH_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"fileName\": \"bloodhound_data.zip\"}'\n```\n\n### Critical BloodHound Queries\n```cypher\n# Find shortest path to Domain Admin\nMATCH p=shortestPath((u:User)-[*1..]->(g:Group {name:\"DOMAIN ADMINS@CORP.LOCAL\"}))\nWHERE u.name \u003C> \"ADMINISTRATOR@CORP.LOCAL\"\nRETURN p\n\n# Find Kerberoastable accounts with admin privileges\nMATCH (u:User {hasspn:true})-[:MemberOf*1..]->(g:Group)\nWHERE g.name CONTAINS \"ADMIN\"\nRETURN u.name, u.serviceprincipalnames\n\n# Find computers where Domain Admins are logged in\nMATCH (c:Computer)-[:HasSession]->(u:User)-[:MemberOf*1..]->(g:Group {name:\"DOMAIN ADMINS@CORP.LOCAL\"})\nRETURN c.name, u.name\n\n# Find AS-REP roastable accounts\nMATCH (u:User {dontreqpreauth:true})\nRETURN u.name, u.description\n\n# Find unconstrained delegation hosts\nMATCH (c:Computer {unconstraineddelegation:true})\nWHERE NOT c.name CONTAINS \"DC\"\nRETURN c.name\n\n# Find GPO abuse paths\nMATCH p=(u:User)-[:GenericAll|GenericWrite|WriteOwner|WriteDacl]->(g:GPO)\nRETURN p\n```\n\n## Tool 3: Purple Knight Assessment\n\n```powershell\n# Download Purple Knight from https:\u002F\u002Fwww.purple-knight.com\u002F\n# Run as domain admin or with appropriate read permissions\n\n.\\PurpleKnight.exe\n\n# Purple Knight checks 130+ security indicators across:\n# - Account Security (password policies, privileged accounts)\n# - AD Infrastructure (replication, DNS, LDAP signing)\n# - Group Policy (GPO permissions, security settings)\n# - Kerberos Security (delegation, encryption types, SPN)\n# - AD Delegation (AdminSDHolder, OU permissions)\n```\n\n### Purple Knight Score Categories\n| Score Range | Rating | Action Required |\n|------------|--------|----------------|\n| 90-100 | Excellent | Maintain current posture |\n| 75-89 | Good | Address high-risk findings |\n| 60-74 | Fair | Prioritize remediation plan |\n| 40-59 | Poor | Immediate remediation required |\n| 0-39 | Critical | Emergency response needed |\n\n## Common AD Vulnerabilities\n\n### 1. Kerberoasting Exposure\n```powershell\n# Find SPNs assigned to user accounts (Kerberoasting targets)\nGet-ADUser -Filter {ServicePrincipalName -ne \"$null\"} -Properties ServicePrincipalName |\n  Select-Object Name, ServicePrincipalName, PasswordLastSet, Enabled\n```\n\n### 2. AS-REP Roasting Exposure\n```powershell\n# Find accounts with pre-auth disabled\nGet-ADUser -Filter {DoesNotRequirePreAuth -eq $true} -Properties DoesNotRequirePreAuth |\n  Select-Object Name, DoesNotRequirePreAuth, Enabled\n```\n\n### 3. LLMNR\u002FNBT-NS Poisoning Risk\n```powershell\n# Check if LLMNR is disabled via GPO\nGet-ItemProperty \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\DNSClient\" -Name EnableMulticast -ErrorAction SilentlyContinue\n```\n\n### 4. Excessive Privileged Group Membership\n```powershell\n# Count members in critical groups\n$groups = @(\"Domain Admins\", \"Enterprise Admins\", \"Schema Admins\", \"Account Operators\", \"Backup Operators\")\nforeach ($group in $groups) {\n    $count = (Get-ADGroupMember -Identity $group -Recursive).Count\n    Write-Output \"$group : $count members\"\n}\n```\n\n## Remediation Priorities\n\n| Finding | Risk | Remediation |\n|---------|------|-------------|\n| Kerberoastable admin accounts | Critical | Remove SPNs or use MSA\u002FgMSA |\n| Unconstrained delegation on non-DCs | Critical | Switch to constrained\u002FRBCD |\n| Password Never Expires on admins | High | Enable password rotation policy |\n| AS-REP roastable accounts | High | Enable Kerberos pre-authentication |\n| AdminSDHolder modification | High | Audit and restore default ACLs |\n| Stale computer accounts (90+ days) | Medium | Disable and move to quarantine OU |\n| LDAP signing not enforced | Medium | Enable via GPO on all DCs |\n\n## References\n\n- [PingCastle GitHub](https:\u002F\u002Fgithub.com\u002Fnetwrix\u002Fpingcastle)\n- [BloodHound CE](https:\u002F\u002Fgithub.com\u002FSpecterOps\u002FBloodHound)\n- [Purple Knight](https:\u002F\u002Fwww.purple-knight.com\u002F)\n- [MITRE ATT&CK - Active Directory](https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1484\u002F)\n- [Microsoft AD Security Best Practices](https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows-server\u002Fidentity\u002Fad-ds\u002Fplan\u002Fsecurity-best-practices\u002Fbest-practices-for-securing-active-directory)\n",{"name":5,"tags":41,"author":42,"domain":33,"license":15,"version":43,"nist_csf":44,"subdomain":28,"description":7,"mitre_attack":49,"d3fend_techniques":55},[32,25,27,24,23,31,30,26],"mahipal","1.0",[45,46,47,48],"ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06",[50,51,52,53,54],"T1190","T1203","T1068","T1548","T1134",[56,57,58,59,60],"Restore Object","Network Traffic Policy Mapping","Restore Configuration","Access Modeling","Operational Activity Mapping","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-active-directory-vulnerability-assessment",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":72,"prompt":82,"zipAvailable":83},[73,76,79],{"tool":74,"command":75},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-active-directory-vulnerability-assessment",{"tool":77,"command":78},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-active-directory-vulnerability-assessment",{"tool":80,"command":81},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-active-directory-vulnerability-assessment","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-vulnerability-assessment\u002FSKILL.md",true,[85,91,96,102,106,110,116],{"path":86,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"assets\u002Ftemplate.md","ASSET","资产文件",2489,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-vulnerability-assessment\u002Fassets\u002Ftemplate.md",{"path":92,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-vulnerability-assessment\u002FLICENSE",{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"references\u002Fapi-reference.md","REFERENCE","参考文档",2524,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-vulnerability-assessment\u002Freferences\u002Fapi-reference.md",{"path":103,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fstandards.md",1663,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-vulnerability-assessment\u002Freferences\u002Fstandards.md",{"path":107,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fworkflows.md",2021,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-vulnerability-assessment\u002Freferences\u002Fworkflows.md",{"path":111,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":114,"sourceHtmlUrl":115},"scripts\u002Fagent.py","SCRIPT","脚本",6777,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-vulnerability-assessment\u002Fscripts\u002Fagent.py",{"path":117,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":118,"sourceHtmlUrl":119},"scripts\u002Fprocess.py",7989,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-vulnerability-assessment\u002Fscripts\u002Fprocess.py",[121,151,174,202,228,254],{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":132,"publishedAt":36},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[127],{"categoryNo":128,"categoryName":129,"taxonomyType":130,"taxonomyTypeDesc":131},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[133,134,135,136,35,33,137,138,139,140,141,142,143,144,145,146,147,148,149,150],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":158,"publishedAt":36},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[157],{"categoryNo":128,"categoryName":129,"taxonomyType":130,"taxonomyTypeDesc":131},[159,147,160,161,35,34,33,139,162,163,164,165,166,167,168,169,170,171,172,173],"boot","TPM","validating tpm measured boot attestation","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":175,"name":176,"nameZh":6,"description":177,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":178,"categories":179,"keywords":184,"publishedAt":36},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[180,183],{"categoryNo":181,"categoryName":182,"taxonomyType":130,"taxonomyTypeDesc":131},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":128,"categoryName":129,"taxonomyType":130,"taxonomyTypeDesc":131},[168,185,186,187,188,33,189,190,162,191,192,193,194,195,196,197,198,199,200,201],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":203,"name":204,"nameZh":6,"description":205,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":206,"categories":207,"keywords":209,"publishedAt":36},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[208],{"categoryNo":128,"categoryName":129,"taxonomyType":130,"taxonomyTypeDesc":131},[210,211,212,33,213,214,215,216,217,218,219,220,221,222,223,224,165,225,226,227],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":229,"name":230,"nameZh":6,"description":231,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":232,"categories":233,"keywords":235,"publishedAt":36},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[234],{"categoryNo":128,"categoryName":129,"taxonomyType":130,"taxonomyTypeDesc":131},[236,237,238,33,239,240,241,28,242,243,244,245,246,247,248,249,250,251,252,253],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":255,"name":256,"nameZh":6,"description":257,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":258,"categories":259,"keywords":261,"publishedAt":36},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[260],{"categoryNo":128,"categoryName":129,"taxonomyType":130,"taxonomyTypeDesc":131},[35,262,33,263,264,265,266,267,268,269,270,197,271,198,272,273,274,275,276,277],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]