Анализ злоупотреблений ACL в Active Directory

★ 8.4 · security

analyzing-active-directory-acl-abuse is a Claude Code skill that detects dangerous ACL misconfigurations in Active Directory using the ldap3 Python library. It connects to a Domain Controller via LDAP (port 389) or LDAPS (port 636), retrieves the nTSecurityDescriptor attribute for domain objects, parses the binary security descriptor into SDDL format, and identifies ACEs granting non-privileged principals permissions such as GenericAll, WriteDACL, WriteOwner, and GenericWrite on sensitive targets like Domain Admins groups, domain controllers, or GPOs. Each finding includes a mapped attack chain — for example, GenericAll on a group enables arbitrary membership changes — and the skill outputs a structured JSON report listing affected objects, trustees, access masks, and remediation steps. Security engineers use it for incident investigations, threat hunting, and validating detection coverage against privilege-escalation techniques similar to those surfaced by BloodHound.