본문으로 건너뛰기
cccskills
무료GitHub에 공개

compliance-mapping

A high-level conceptual mapping from Active Directory attack techniques to the compliance controls they touch. Kerberoasting relates to authentication and logging, so it brushes ENS op.acc.5 / op.exp.8, NIS2 Art.21(2)(h), DORA RTS Art.9 / Art.21. Use this when a reader wants to understand which regulatory control an AD finding relates to, or to add an orientation note to a technical finding. This is a conceptual, orientative mapping only; it is NOT an auditor-defensible, curated, ID-by-ID control matrix. Covers ENS (op.acc.*, op.exp.*), NIS2 (Directive 2022/2555 Art.21), and DORA (RTS 2024/1774).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

ADScanPro/Claude-AD
설치 방법 보기

포함된 파일(1)

  • SKILL.md6.5 KB

SKILL.md(원문)

설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.

AD Technique → Compliance Control (Conceptual Mapping)

Disclaimer, read first. This is a conceptual, orientative mapping. It shows, at a high level, which family of controls an AD attack technique relates to, so a practitioner can point a finding in the right regulatory direction. It is not an auditor-defensible control matrix. A defensible mapping (one an auditor accepts, cross-referenced ID by ID to the exact control text, scoped to your organization's applicability statement, with evidence per control) is a curated product, not something you infer from a technique name. ADscan (free and source-available) produces that curated, ID-by-ID matrix as part of its report. Use this skill to orient a finding; do not present it to an auditor as compliance evidence.

How to read this

An AD technique succeeds because a control is weak or absent. Kerberoasting works because service-account authentication is weak and the requests are not monitored, so it relates to the authentication and logging control families. That relationship is conceptual: it tells a reader where in a framework to look, not that the finding satisfies or violates a specific control clause. The mapping direction is always technique → control family → representative article, and it stops there.

The frameworks, briefly

  • ENS (Esquema Nacional de Seguridad, Spain): control families used here:
    • op.acc.1 Identificación
    • op.acc.4 Proceso de gestión de derechos de acceso
    • op.acc.5 Mecanismo de autenticación (usuarios externos)
    • op.acc.6 Mecanismo de autenticación (usuarios de la organización)
    • op.exp.2 Configuración de seguridad
    • op.exp.8 Registro de la actividad
    • op.exp.10 Protección de claves criptográficas
  • NIS2 (Directive (EU) 2022/2555): Art.21(2) cybersecurity risk-management measures:
    • (g) basic cyber hygiene and training
    • (h) cryptography and encryption
    • (i) human resources security, access control policies, asset management
    • (j) multi-factor authentication, secured communications
  • DORA (Regulation (EU) 2022/2554) with RTS (EU) 2024/1774 on ICT risk management:
    • Art.20: identity management
    • Art.21: access control (management of access rights)
    • Art.9 (DORA level-1, protection and prevention) is the parent duty the RTS details

The mapping

Kerberoasting / AS-REP roasting

Weak service-account or pre-auth-disabled credentials cracked offline. Touches authentication strength and activity logging (the ticket requests should be monitored).

  • ENS: op.acc.5 / op.acc.6 (authentication mechanism), op.exp.8 (activity logging)
  • NIS2: Art.21(2)(h) cryptography, Art.21(2)(i) access-control policy
  • DORA: RTS Art.21 access control, Art.9 (protection/prevention parent)

DCSync

Replication of the credential database using directory-replication rights. Touches access-rights management (who holds Get-Changes) and logging.

  • ENS: op.acc.4 (access-rights management), op.acc.1 (identification), op.exp.8 (logging)
  • NIS2: Art.21(2)(i) access control, Art.21(2)(j) secured communications
  • DORA: RTS Art.20 identity management, Art.21 access control

ACL abuse (GenericAll / WriteDACL / WriteOwner)

Excessive or misconfigured object permissions used to escalate. Touches access-rights management and secure configuration.

  • ENS: op.acc.4 (access-rights management), op.exp.2 (security configuration)
  • NIS2: Art.21(2)(i) access control and asset management
  • DORA: RTS Art.21 access control

AD CS abuse (ESC1-ESC17)

Certificate-template and PKI misconfiguration leading to authentication as another principal. Touches cryptographic-key protection, secure configuration, and authentication.

  • ENS: op.exp.10 (cryptographic-key protection), op.exp.2 (configuration), op.acc.5/op.acc.6
  • NIS2: Art.21(2)(h) cryptography, Art.21(2)(i) access control
  • DORA: RTS Art.21 access control, Art.9 (protection/prevention)

Kerberos delegation abuse (unconstrained / constrained / RBCD)

Delegation misconfiguration used to impersonate. Touches access-rights management and secure configuration.

  • ENS: op.acc.4 (access-rights management), op.exp.2 (configuration)
  • NIS2: Art.21(2)(i) access control
  • DORA: RTS Art.21 access control

Coercion + NTLM relay

Forced authentication relayed to escalate; weak signing/channel-binding configuration. Touches secured communications and secure configuration.

  • ENS: op.exp.2 (security configuration), op.acc.5/op.acc.6 (authentication)
  • NIS2: Art.21(2)(j) secured communications, Art.21(2)(h) cryptography
  • DORA: RTS Art.21 access control, Art.9 (protection/prevention)

Password spraying / weak-credential findings

Weak or reused passwords and missing MFA. Touches authentication and cyber hygiene.

  • ENS: op.acc.5/op.acc.6 (authentication mechanism), op.acc.1 (identification)
  • NIS2: Art.21(2)(j) MFA, Art.21(2)(g) cyber hygiene
  • DORA: RTS Art.20 identity management, Art.21 access control

Credential exposure (GPP passwords, LDAP descriptions, shares)

Secrets left in SYSVOL, object attributes, or file shares. Touches cryptographic-key / secret protection and secure configuration.

  • ENS: op.exp.10 (key protection), op.exp.2 (configuration), op.acc.4 (access-rights)
  • NIS2: Art.21(2)(h) cryptography, Art.21(2)(i) asset management
  • DORA: RTS Art.21 access control

Using this in a report

Attach one line of orientation to a finding, such as "relates to ENS op.acc.5 and NIS2 Art.21(2)(h)", so the reader knows the regulatory neighbourhood. Then stop. Do not stretch a conceptual relationship into a compliance verdict, do not claim the finding proves non-compliance with a specific clause, and do not present this as the control matrix an auditor signs off on. That curated, evidence-backed, ID-by-ID matrix is a separate, deliberate piece of work.

리뷰

아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.

댓글

로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.

아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.

보내면 바로 공개됩니다. 이메일 주소나 전화번호 같은 개인 정보는 쓰지 마세요. URL은 2개까지입니다.

0 / 1,000자

이 양식은 reCAPTCHA로 보호되며 Google 개인정보처리방침 및 서비스 약관이 적용됩니다.

같은 저장소의 스킬

acl-abuse

무료

Abusing Active Directory object ACLs (DACL/ownership) for privilege escalation and lateral movement (GenericAll, GenericWrite, WriteDACL, WriteOwner, AddMember, ForceChangePassword, and replication rights via DS-Replication-Get-Changes-All). Use when BloodHound CE shows an outbound control edge from a principal you own toward a higher-value object, and you want the exact bloodyAD/impacket command to weaponize that ACE, plus detection and remediation. DCSync is covered here strictly as a post-compromise technique, not a user entry path.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

ADScanPro/Claude-AD2122026년 8월 25일 업데이트

ad-environment-constraints

무료

Real-world Active Directory environment constraints that silently break attacks when ignored: NTLM disabled (Kerberos fallback), AES-only KDCs (RC4 blocked by GPO), LDAP signing and channel binding requiring LDAPS on 636, Kerberos clock skew (KRB_AP_ERR_SKEW), SPNs that must be FQDNs never short names or IPs (the misleading invalidCredentials), Protected Users / LAPS / gMSA / MachineAccountQuota, LDAP 1000-object paging, and VPN latency. Use this whenever a bind, TGT request, LDAP query, or SMB negotiation fails in a way that looks like bad credentials but is really hardening, or before running any AD tooling against a domain you have not fingerprinted. Standard-tooling knowledge (netexec, impacket, certipy, bloodyAD, kerbrute), no vendor-specific engine.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

ADScanPro/Claude-AD2122026년 8월 25일 업데이트

ad-methodology

무료

The order of operations for an Active Directory penetration test: setup, collection, exploitation, post-processing. Use this whenever you are planning or driving an AD assessment and need to know what to run before what and why (map before you exploit; harvest easy credentials before spraying to avoid lockouts; collect the graph before you reason about paths). Covers phase sequencing with standard tooling: netexec/nxc, impacket, certipy, bloodyAD, kerbrute, BloodHound CE. Invoke it at the start of an engagement, when deciding the next phase, or when a step feels out of order.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

ADScanPro/Claude-AD2122026년 8월 25일 업데이트

ad-opsec-telemetry

무료

The telemetry each Active Directory technique generates and what alerts a defender: Kerberoasting produces Event 4769 with RC4 encryption (0x17) and an MDI alert, DCSync produces Event 4662 with the DS-Replication-Get-Changes GUID, AS-REP roasting produces Event 4768 with no pre-auth, LSASS dumping is blocked by EDR, plus a lateral-movement telemetry table by protocol (SMB/WMI/WinRM/RDP/DCOM). Use this whenever you run or plan an offensive AD technique and need to know what noise it makes, when writing the engagement's detection notes, or when a defender wants to know what to monitor. Teaches red teamers what is loud and blue teamers what to watch. Standard-tooling knowledge, no vendor engine.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

ADScanPro/Claude-AD2122026년 8월 25일 업데이트

adcs-attacks

무료

Active Directory Certificate Services (AD CS) escalation techniques ESC1 through ESC17, driven by hand with Certipy (ly4k). Use when the target runs a Certificate Authority and you want to find vulnerable certificate templates or CA misconfigurations, request a certificate that impersonates a privileged user, and know the exact certipy command, what each ESC actually checks, the Windows Event IDs that fire, and the remediation. ESC1 and ESC8 are the two you hit most in the field.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

ADScanPro/Claude-AD2122026년 8월 25일 업데이트

coercion-ntlm-relay

무료

Authentication coercion (PetitPotam MS-EFSR, PrinterBug MS-RPRN, DFSCoerce MS-DFSNM) chained into NTLM relay (impacket ntlmrelayx) toward LDAP, AD CS web enrollment (ESC8), or SMB. Use when SMB signing is not enforced or LDAP channel binding is missing, and you want to force a privileged machine account to authenticate to your relay and turn that into RBCD, a DCSync-capable ACL grant, or a certificate. Includes the exact Coercer/ntlmrelayx commands, requirements, detection, and remediation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

ADScanPro/Claude-AD2122026년 8월 25일 업데이트

ADScanPro의 스킬 모두 보기

이 스킬의 문제 신고