What problem does it solve? Detection engineers often write rules that match specific attacker tools instead of the underlying protocol abuse, leaving gaps that trivial tool changes evade. This Skill provides the Active Directory internals — Kerberos, NTLM, replication, delegation, GPO, AD CS, and LDAP — needed to author detections grounded in protocol behavior and the correct Windows Event IDs. ## Core Features & Use Cases - Protocol-level attack mechanics: Covers Kerberos flows (AS-REQ/TGT/TGS), Kerberoasting, AS-REP roasting, NTLM relay and pass-the-hash, DCSync, DCShadow, delegation abuse (unconstrained/constrained/RBCD), and AD CS escalation paths ESC1–ESC13. - Telemetry mapping: Maps each attack technique to concrete detection signals such as Event IDs 4768, 4769, 4771, 4776, 4662, 5136, and 4886/4887, including replication GUIDs and encryption-type anomalies. - Use Case: When writing a Kerberoasting detection, use this Skill to confirm that EID 4769 with RC4 encryption type 0x17 is the right signal, and to check for false positives from legacy applications before deploying the rule. ## Quick Start Ask the agent to explain how to detect DCSync attacks using domain controller event logs and which Event IDs and replication GUIDs to alert on.
