skills.rest
OpenTideHQ
OpenTideHQOFFICIAL
Explore all skills by this author →
WebsiteGitHub

active-directory

Map Active Directory authentication, replication, and trust mechanisms to detection requirements.

4|1|Updated Apr 28, 2026
Search Tags:#active-directory#kerberos#dcsync#ntlm#group-policy#ad-cs#drs
One-click install
npx skills add https://github.com/OpenTideHQ/AgentTide --skill active-directory-opentidehq
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: active-directory
Source: https://github.com/OpenTideHQ/AgentTide/tree/main/skills/active-directory
Command: npx skills add https://github.com/OpenTideHQ/AgentTide --skill active-directory-opentidehq

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Active Directory detection engineering requires deep knowledge of Kerberos, NTLM, AD replication, trust and delegation to craft robust, protocol-level detections that resist tool-specific blind spots.

Core Features & Use Cases

  • In-depth coverage of Kerberos flows, NTLM mechanics, DRS/DCSync, trust/delegation models, GPO processing, and AD CS tampering paths.
  • Telemetry mapping and event references to support detections across on-premises AD environments.
  • Example use-case: develop a detector for Kerberoasting by tying SPN discovery to service ticket requests and encryption type signals.

Quick Start

Analyze AD authentication, replication, and trust events to inform detection logic.

Frequently Asked Questions about active-directory

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect DCSync reconnaissance in Active Directory?▼

Map DRS protocol replication requests to specific telemetry patterns and event thresholds to detect DCSync reconnaissance, isolating unauthorized directory replication behavior in on-premises AD.

What is the best way to detect Kerberoasting using protocol-level telemetry?▼

Detect Kerberoasting by tying service principal name discovery requests to subsequent service ticket requests and analyzing encryption type signals to identify anomalous Kerberos flows.

Can I build detections for GPO and AD CS abuse paths in on-premises environments?▼

Yes, you can build detections for GPO and AD CS abuse by specifying protocol-level behaviors and mapping telemetry data sources to identify tampering paths within on-premises AD environments.

Do I need deep knowledge of NTLM and Kerberos flows to create robust AD detections?▼

Yes, robust AD detection engineering requires deep knowledge of NTLM mechanics and Kerberos flows to craft protocol-level detections that resist tool-specific blind spots across authentication events.

How does mapping AD trust and delegation models improve detection engineering?▼

Mapping AD trust and delegation models to detection requirements improves engineering by specifying protocol-level behaviors and validated strategies, ensuring precise detections across complex authentication mechanisms.

Related Skills

Explore More Data & Analytics Skills→
pingqLINpingqLIN

cloudflare-zerotrust-device

Diagnose local Cloudflare WARP and Zero Trust state using bundled scripts.

Community
Advanced
jaskaranhundaljaskaranhundal
3

detection-engineering

Design, validate, and tune detection rules across SIEM, EDR, and cloud telemetry.

Community
Advanced
polaris-dxzpolaris-dxz
1

log-analyzer

Analyze and correlate multi-source logs to detect anomalies and trends.

Community
Intermediate
SeeKTSeeKT

elk-skill

Analyze Windows Event Logs and Sysmon data with Elastic Stack to detect Active Directory threats.

Community
Advanced