Evaluris Solutions
Offensive securityMIT

Claude Active Directory

ROE-first AI harness for authorized Active Directory offensive security

  • Python 3.8+
  • Claude Code plugin (Cursor and Gemini via install scripts)
View on GitHubAll tools

8

Skill domains

13

Slash commands

7

Agents

Part of DoOS, Department of Offensive Security

Highlights

What you get

  • Engagement-aware methodology from recon through reporting
  • Finding validation gates before client-facing deliverables
  • MITRE ATT&CK-aligned skill domains for Kerberos, LDAP, AD CS, and delegation
  • Optional Burp MCP integration for OWA, AD FS, and cert enrollment surfaces
Overview

About this tool

Claude Active Directory turns Claude Code into a structured copilot for authorized Active Directory penetration testing and red team work. Instead of ad hoc prompts, operators get consistent methodology, evidence discipline, and report-ready outputs aligned to real engagement phases.

The harness ships as part of DoOS (Department of Offensive Security) at Evaluris Solutions Labs. It bundles skill domains, slash commands, and specialized agents that mirror how senior operators run assessments: scope first, hunt with intent, validate before you report.

Install once per environment, run `/scope` at the start of every engagement, and use the built-in validation and reporting flows to reduce false positives and keep deliverables defensible.

Capabilities

Skill domains

  • ad-pentest

    Master workflow: ROE, phases, path hunting, deliverables

  • ad-methodology

    Engagement pacing, stuck routing, session discipline

  • ad-recon

    DNS, trusts, LDAP/LDAPS, SMB, Kerberos, BloodHound collection

  • ad-attack-classes

    Technique reference, coercion, lateral matrix, trust and SQL paths

  • ad-arsenal

    Tool patterns, Event IDs, OPSEC and telemetry awareness

  • ad-cs-pki

    AD CS / PKI, ESC evidence, DC certificate posture

  • finding-validation

    False positive triage, severity rubric, ATT&CK mapping

  • engagement-reporting

    Executive and technical structure, AD finding fields

Capabilities

Slash commands

  • /scope

    Canonical ROE check, run first on every engagement

  • /recon

    DNS, LDAP, SMB, Kerberos discovery, BloodHound prep

  • /hunt

    Credential access and privilege escalation phase

  • /validate

    Validate a finding before client report

  • /report

    Engagement-style technical report from validated findings

  • /chain

    Multi-hop attack path narrative

  • /autopilot

    Phased ROE-safe checklist

  • /web3-audit

    AD CS / PKI audit workflow (legacy command name)

Capabilities

Agents

  • recon-agent

    Recon guidance to enumeration summary

  • validator

    Finding QA: PASS / KILL / DOWNGRADE / CHAIN

  • report-writer

    Report drafting from validated findings

  • chain-builder

    Multi-hop chain narratives

  • ad-cs-auditor

    PKI and ESC review

  • autopilot

    Phased engagement checklist

Setup

Installation

  1. 01git clone https://github.com/Evaluris-Solutions/claude-active-directory.git
  2. 02cd claude-active-directory
  3. 03chmod +x install.sh scripts/install.sh scripts/convert.sh && ./install.sh
  4. 04For Cursor: ./install.sh cursor
  5. 05For Gemini or other CLIs: ./install.sh gemini or ./scripts/convert.sh --flat ./export
  6. 06Optional: bash install_tools.sh for companion tooling; python3 tools/hunt.py --target corp.local for orchestration stub
Workflow

Usage notes

  • •Run /scope before any testing to confirm authorization, allow lists, and exclusions.
  • •Validate findings with /validate or /triage before customer-facing reports.
  • •Use /remember for engagement memory without storing classified customer data in the repo.
  • •See rules/hunting.md and SECURITY.md in the repository for operational guidance.
Audience

Who this is for

  • Authorized AD penetration testers and red team operators who want repeatable methodology in Claude Code
  • Internal security teams building purple-team evidence and detection coverage maps
  • Consultancies that need consistent finding validation and client-ready reporting across engagements
  • Practitioners studying Kerberos, LDAP, AD CS, delegation, and BloodHound-style path analysis under ROE
Authorization

Authorized use only

This tool is intended for lawful, authorized security work only.

  • •Use only on systems you own or are explicitly authorized to test in writing.
  • •Align spray, relay, and destructive actions with agreed rules of engagement.
  • •Stop and obtain legal and stakeholder sign-off if authorization is unclear.
More tools

Related tools

Hedera Claude Skills

Production-grade Claude Code skills for building on Hedera Hashgraph

View tool

Get the source on GitHub

Install instructions, issues, and contributions live in the Evaluris-Solutions organization repository.

Open repository