SKILL: AD ACL Abuse, Expert Attack Playbook

AI LOAD INSTRUCTION: Expert AD ACL abuse techniques. Covers BloodHound enumeration, dangerous ACEs (GenericAll, WriteDACL, WriteOwner, etc.), DCSync, shadow credentials, targeted kerberoasting, group manipulation, LAPS, and GPO abuse. Base models miss complex ACL chain exploitation and Cypher query patterns.

0. RELATED ROUTING

Before going deep, consider loading:

• active-directory-kerberos-attacks for Kerberos attacks often chained with ACL abuse
• active-directory-certificate-services for certificate-based attacks after ACL exploitation
• ntlm-relay-coercion for relay attacks that can set ACLs (LDAP relay)
• windows-lateral-movement after gaining elevated AD access

Advanced Reference

Also load BLOODHOUND_PATHS.md when you need:

• Common BloodHound attack paths with Cypher queries
• Custom Neo4j queries for finding complex chains
• Data collection and ingestion tips

---

1. BLOODHOUND ENUMERATION

Data Collection

# SharpHound (from Windows, domain-joined)
SharpHound.exe -c all --outputdirectory C:\temp --zipfilename bh.zip

# bloodhound-python (from Linux)
bloodhound-python -d domain.com -u user -p password -c all -dc DC01.domain.com -ns DC_IP

# Specific collection methods
SharpHound.exe -c DCOnly          # Fastest, only DC queries
SharpHound.exe -c Session         # Session data only (run periodically)
SharpHound.exe -c All,GPOLocalGroup  # Include GPO analysis

Key BloodHound Queries (Built-in)

• "Find all Domain Admins"
• "Shortest Paths to Domain Admins from Owned Principals"
• "Find Principals with DCSync Rights"
• "Shortest Paths to Unconstrained Delegation Systems"
• "Find computers where Domain Users are Local Admin"

---

2. DANGEROUS ACE TYPES