agentsclimarketplace
Sign in

Hunting active directory attacks

Skill meltedinhex/analyst-ai-pack/skills/hunting-active-directory-attacks

Hunts for Active Directory credential and replication attacks — DCSync, Golden/Silver Ticket, and DCShadow — by analyzing directory-service-access (4662), Kerberos TGS (4769), and logon (4624) events for replication abuse and forged-ticket anomalies. Activates for requests to hunt DCSync, detect golden/silver tickets, or find Active Directory replication abuse.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill hunting-active-directory-attacks

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 21 stars21 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.9 KB, 479 tokens by cl100k_base, as published. Nobody here has run it

Hunting Active Directory Attacks

When to Use

  • You have AD/domain-controller telemetry (Event IDs 4662, 4769, 4624) and want to detect DCSync replication abuse, Golden/Silver Ticket usage, and DCShadow.
  • You are investigating credential-access and domain-persistence activity.

Do not use this for Kerberoasting/AS-REP roasting — those have a dedicated hunt. This focuses on replication abuse and forged-ticket anomalies.

Prerequisites

  • Event ID 4662 (directory service access), 4769 (TGS requests), and 4624 (logons) with account and detail fields.

Workflow

Step 1: Hunt DCSync replication abuse

python scripts/analyst.py hunt events.csv

Flags 4662 events granting the replication rights GUIDs (DS-Replication-Get-Changes 1131f6aa-… / -All 1131f6ad-…) to non-DC accounts.

Step 2: Detect forged-ticket anomalies

Surface 4769 requests with anomalies consistent with Golden/Silver Tickets (RC4 where AES is expected, missing preceding 4768, or accounts that do not exist), and logons with mismatched ticket lifetimes.

Step 3: Confirm

Correlate the flagged account/host with whether it is a legitimate DC or replication service.

Step 4: Operationalize

Write a detection for replication-rights grants to non-DC principals.

Validation

  • DCSync flags key on the replication GUIDs granted to non-DC accounts.
  • Forged-ticket anomalies are based on encryption type / missing-AS-REQ evidence.
  • Findings map to ATT&CK T1003.006 / T1558.001.

Pitfalls

  • Legitimate DCs and Azure AD Connect perform replication — allow-list them.
  • Golden Tickets can perfectly mimic valid TGS; rely on corroborating anomalies, not one signal.
  • Incomplete auditing (4662 object-access auditing must be enabled) causing blind spots.

References

What ships with it: 3 files

4.5 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.