Active Directory defense

SkillMonitoring & ops

Detect and harden against Active Directory attacks, Kerberoasting, AS-REP roasting, DCSync, ADCS abuse, and delegation/relay. Load for "detect kerberoasting", "harden AD", "AD monitoring", "did someone DCSync us", or defending a domain. The defensive counterpart to the ad-* offensive skills.

Instructions available. Your AI can read the instructions. Execution depends on the setup they require.

Account requirements not reviewed. Check the skill instructions before use; ahel provides instructions and does not run this skill.

Add ahel to your AI once: Claude, ChatGPT, Cursor, Claude Code or Codex. Then ask it to use this.

Then ask your AI: use the Active Directory defense skill

What this skill tells your AI

The instructions your AI receives, as published by noorqureshi/sploitagent in skills/defense/defense-ad-defense/SKILL.md and read by ahel’s review.

When it applies

You run an AD domain and need to catch the standard attacker toolkit and close the structural weaknesses it relies on — before or after a foothold.

Why it works

Most AD attacks abuse features, not bugs, so they leave predictable event signatures and depend on specific misconfigurations. Watch the right events and remove the preconditions, and the common paths (the ones BloodHound finds) simply close.

Method

Kerberoasting (T1558.003): alert on Event 4769 (TGS request) with RC4 (0x17) encryption or high volume from one account. Harden: strong (25+ char) managed service-account passwords, gMSAs, and AES-only where possible.
AS-REP roasting (T1558.004): find and fix accounts with "do not require Kerberos preauth"; alert on 4768 without preauth.
DCSync (T1003.006): alert on 4662 replication GUIDs (DS-Replication-Get-Changes) from a principal that is not a DC. Harden: audit who holds replication rights.
ADCS (ESC1-8, T1649): audit templates for enrollee-supplied SAN + client-auth EKU (ESC1) and dangerous enrollment rights; monitor 4886/4887 (cert requests/issues). Fix the template.
Delegation / relay (T1207): inventory unconstrained/RBCD delegation; enable SMB signing + LDAP channel binding/signing to kill NTLM relay; monitor for coercion (PetitPotam-style).
Structural hygiene: run PingCastle/BloodHound as the defender, tier admin accounts, Protected Users group, LAPS for local admin, and remove the attack-graph edges (see tradecraft-attack-path-mapping).

Gotchas

4769 fires constantly — key on RC4/volume/odd source, not the raw event.
Legacy apps may need RC4/unconstrained delegation; document exceptions, don't leave them silent.
ADCS is often the fastest domain-takeover path and the least monitored — prioritise it.

Verify success

A controlled roast/DCSync/ESC1 in a lab produces the expected event and alerts, and a BloodHound run shows the corresponding attack-graph edge removed after hardening.

References

Microsoft AD security docs; SpecterOps ADCS ("Certified Pre-Owned"); PingCastle; MITRE ATT&CK.

Signals

GitHub stars: 20
Forks: 7
Last commit: Sep 2026

Advanced

Item type: skill
Key: defense-ad-defense
Source: github.com/noorqureshi/sploitagent

github.com/noorqureshi/sploitagent