# AI use cases for Claude AD (ADScanPro/Claude-AD) Repo: [ADScanPro/Claude-AD](https://github.com/ADScanPro/Claude-AD) | Use cases: 4 | Page: https://dedupedai.com/use-cases/adscanpro-claude-ad/ Claude-AD is a Claude Code plugin that gives Claude an Active Directory pentest method: skills, agents and slash commands for authorized internal assessments that drive standard tools such as netexec, impacket, certipy, bloodyAD and BloodHound CE. This file holds every use case of this repo. Each one starts with a "## " heading and ends with its URL. - Scope an AD assessment in the right phase order: https://dedupedai.com/use-cases/adscanpro-claude-ad/scope-ad-assessment-phase-order/ - Map low-privilege to Domain Admin attack paths: https://dedupedai.com/use-cases/adscanpro-claude-ad/map-low-priv-to-domain-admin-paths/ - Review ADCS ESC1 through ESC17 misconfigurations: https://dedupedai.com/use-cases/adscanpro-claude-ad/review-adcs-esc-misconfigurations/ - Map AD findings to DORA, NIS2 and ENS controls: https://dedupedai.com/use-cases/adscanpro-claude-ad/map-ad-findings-to-compliance-controls/ ## How to scope an AD assessment in the right phase order with Claude AD Repo: [ADScanPro/Claude-AD](https://github.com/ADScanPro/Claude-AD) | Difficulty: Beginner | Time: 15 minutes | Basis: From the README Use the methodology skills and /ad-scope to plan an authorized internal AD test before any tooling runs. **Who it is for:** A pentester starting an internal Active Directory engagement who wants a structured plan that follows the usual order: map, harvest, collect, then exploit. **The problem:** Jumping straight into exploitation wastes time and misses the environment constraints, such as NTLM disabled or AES-only Kerberos, that break tooling in hardened domains. **The outcome:** A scoped engagement plan that follows the phase order and lists the environment constraints to check before testing. ### Steps 1. Install the plugin in Claude Code by running `/plugin marketplace add ADScanPro/Claude-AD`. 2. Install the plugin by running `/plugin install claude-ad@claude-ad`. 3. Start an engagement session and run `/ad-scope` to define the authorized targets and rules. 4. Ask Claude to walk through the ad-methodology and ad-environment-constraints skills for this domain. 5. Save the scope and phase plan before running any collection. ### Prompt to paste into your agent ```text Using the Claude-AD repo (ADScanPro/Claude-AD), run /ad-scope for the authorized internal domain and produce a written scope with the phase order and the environment constraints to check. Verify that the scope names the authorized targets and explicitly excludes anything outside the signed authorization. ``` ### Caveat Claude AD carries the method only; you still run every tool and read every result yourself. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/adscanpro-claude-ad/scope-ad-assessment-phase-order/ ## How to map low-privilege to Domain Admin attack paths with Claude AD Repo: [ADScanPro/Claude-AD](https://github.com/ADScanPro/Claude-AD) | Difficulty: Advanced | Time: 30 minutes | Basis: From the README Run /ad-recon and /ad-attack-paths to collect the directory graph and reason about paths to Domain Admin. **Who it is for:** A red-team operator who has a low-privilege domain account on an authorized engagement and needs to find the shortest realistic path to Domain Admin. **The problem:** Manually reviewing groups, ACLs and delegation across a large domain is slow, and it is easy to miss a chain of small permissions. **The outcome:** A ranked list of candidate attack paths from the low-privilege account, with the technique behind each step and the telemetry each one leaves. ### Steps 1. Install the plugin with `/plugin marketplace add ADScanPro/Claude-AD` and `/plugin install claude-ad@claude-ad`. 2. Run `/ad-recon` to collect directory data with the standard tooling. 3. Run `/ad-attack-paths` to have the attack planner reason from the low-privilege account to Domain Admin. 4. Review each path against the acl-abuse and kerberos-attacks skills before acting on it. 5. Record the chosen path and the expected detection events for the report. ### Prompt to paste into your agent ```text Using the Claude-AD repo (ADScanPro/Claude-AD), run /ad-recon and then /ad-attack-paths against the authorized domain starting from the low-privilege account . Expected output is a ranked list of candidate paths to Domain Admin with the technique and detection events for each step. Verify that no step is executed or marked as executed without explicit human confirmation. ``` ### Caveat The exploitation agent asks for confirmation before any action that changes the directory, such as a password reset or group add, and you must still verify each result yourself. Risk, credentials: The workflow uses a low-privilege domain account, so keep credentials scoped to the authorized engagement and rotate or remove them afterward. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/adscanpro-claude-ad/map-low-priv-to-domain-admin-paths/ ## How to review ADCS ESC1 through ESC17 misconfigurations with Claude AD Repo: [ADScanPro/Claude-AD](https://github.com/ADScanPro/Claude-AD) | Difficulty: Advanced | Time: 45 minutes | Basis: From the README Check certificate services for ESC1 through ESC17 weaknesses with the adcs-attacks skill and certipy. **Who it is for:** A penetration tester or internal auditor on an authorized engagement who needs to check whether the Active Directory Certificate Services setup has known escalation paths. **The problem:** ADCS misconfigurations are numerous and easy to overlook, and each ESC variant needs a different check. **The outcome:** A list of ADCS templates and settings that map to specific ESC variants, with the certipy command and the fix for each. ### Steps 1. Install the plugin with `/plugin marketplace add ADScanPro/Claude-AD` and `/plugin install claude-ad@claude-ad`. 2. Ask Claude to apply the adcs-attacks skill to the certificate authority in the authorized domain. 3. Have Claude check each ESC variant from ESC1 through ESC17 against the enumerated templates. 4. Note the detection events and the remediation listed for each matched variant. 5. Hand the confirmed findings to the report with their fixes. ### Prompt to paste into your agent ```text Using the Claude-AD repo (ADScanPro/Claude-AD), apply the adcs-attacks skill to the certificate authority in the authorized domain . Expected output is a table of matched ESC variants with the certipy check and the fix for each. Verify that every finding cites a template or setting you actually enumerated. ``` ### Caveat Some ESC checks can change certificate templates in the directory, so confirm scope before running any write action. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/adscanpro-claude-ad/review-adcs-esc-misconfigurations/ ## How to map AD findings to DORA, NIS2 and ENS controls with Claude AD Repo: [ADScanPro/Claude-AD](https://github.com/ADScanPro/Claude-AD) | Difficulty: Intermediate | Time: 30 minutes | Basis: From the README Use the compliance-mapping skill to tie each technique you tested to a control family for an audit report. **Who it is for:** A security consultant or compliance lead who needs to write up an internal AD assessment for an organization under DORA, NIS2 or ENS. **The problem:** Technical findings like Kerberoasting or ESC misconfigurations do not map cleanly to the control language an auditor expects. **The outcome:** A findings table where each technique is linked to a conceptual control family in DORA, NIS2 or ENS, ready for review. ### Steps 1. Install the plugin with `/plugin marketplace add ADScanPro/Claude-AD` and `/plugin install claude-ad@claude-ad`. 2. List the techniques confirmed during the engagement, such as Kerberoasting or ADCS findings. 3. Ask Claude to apply the compliance-mapping skill to each technique for DORA, NIS2 and ENS. 4. Check each mapping against the control text your auditor uses before submitting. 5. Add the mapped findings and their fixes to the report. ### Prompt to paste into your agent ```text Using the Claude-AD repo (ADScanPro/Claude-AD), apply the compliance-mapping skill to these confirmed techniques from the authorized assessment: . Expected output is a table mapping each technique to a conceptual DORA, NIS2 or ENS control family. Verify that each mapping is labeled conceptual and confirmed against the auditor's own control catalog. ``` ### Caveat The mappings are conceptual and do not replace a formal control assessment by your auditor. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/adscanpro-claude-ad/map-ad-findings-to-compliance-controls/