DEDUPED Hot AI repos, turned into use cases Get 5 a day

How to map low-privilege to Domain Admin attack paths with Claude AD

Run /ad-recon and /ad-attack-paths to collect the directory graph and reason about paths to Domain Admin.

Authorization notice. Claude AD is dual-use. Only use it on software, sites and systems you own or have explicit permission to test.

Credentials. The workflow uses a low-privilege domain account, so keep credentials scoped to the authorized engagement and rotate or remove them afterward.

Who it is forA red-team operator who has a low-privilege domain account on an authorized engagement and needs to find the shortest realistic path to Domain Admin.

The problemManually reviewing groups, ACLs and delegation across a large domain is slow, and it is easy to miss a chain of small permissions.

The outcomeA ranked list of candidate attack paths from the low-privilege account, with the technique behind each step and the telemetry each one leaves.

What you need first

  • Claude Code installed
  • Written authorization to test the target domain (your own lab, a contracted engagement, or a CTF)
  • The standard tools the plugin drives (netexec, impacket, certipy, bloodyAD, BloodHound CE) available to you for the engagement

Steps

  1. Install the plugin with /plugin marketplace add ADScanPro/Claude-AD and /plugin install claude-ad@claude-ad.
  2. Run /ad-recon to collect directory data with the standard tooling.
  3. Run /ad-attack-paths to have the attack planner reason from the low-privilege account to Domain Admin.
  4. Review each path against the acl-abuse and kerberos-attacks skills before acting on it.
  5. Record the chosen path and the expected detection events for the report.

Prompt for your agent

Using the Claude-AD repo (ADScanPro/Claude-AD), run /ad-recon and then /ad-attack-paths against the authorized domain <target-domain> starting from the low-privilege account <low-priv-user>. Expected output is a ranked list of candidate paths to Domain Admin with the technique and detection events for each step. Verify that no step is executed or marked as executed without explicit human confirmation.

Caveat. The exploitation agent asks for confirmation before any action that changes the directory, such as a password reset or group add, and you must still verify each result yourself.

Share: X LinkedIn Hacker News Email Copy link

Disclaimer

Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked "Seen in the wild", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email [email protected] and we will look at it promptly. Full disclaimer page