How do I install the Defense Ad Defense skill?

Run npx skillmds@latest add noorqureshi/defense-ad-defense in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Defense Ad Defense safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Defense Ad Defense?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Defense Ad Defense free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Defense Ad Defense?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Defense Ad Defense by noorqureshi — Agent Skill

Name: Defense Ad Defense
Author: NoorQureshi

Defense Ad Defense

Detect and harden against Active Directory attacks — Kerberoasting, AS-REP roasting, DCSync, ADCS abuse, and delegation/relay. Load for "detect kerberoasting", "harden AD", "AD monitoring", "did someone DCSync us", or defending a domain. The defensive counterpart to the ad-* offensive skills.

NoorQureshi Updated Sep 17, 2026

File contents

Active Directory defense

When it applies

You run an AD domain and need to catch the standard attacker toolkit and close the structural weaknesses it relies on — before or after a foothold.

Why it works

Most AD attacks abuse features, not bugs, so they leave predictable event signatures and depend on specific misconfigurations. Watch the right events and remove the preconditions, and the common paths (the ones BloodHound finds) simply close.

Method

Kerberoasting (T1558.003): alert on Event 4769 (TGS request) with RC4 (0x17) encryption or high volume from one account. Harden: strong (25+ char) managed service-account passwords, gMSAs, and AES-only where possible.
AS-REP roasting (T1558.004): find and fix accounts with "do not require Kerberos preauth"; alert on 4768 without preauth.
DCSync (T1003.006): alert on 4662 replication GUIDs (DS-Replication-Get-Changes) from a principal that is not a DC. Harden: audit who holds replication rights.
ADCS (ESC1-8, T1649): audit templates for enrollee-supplied SAN + client-auth EKU (ESC1) and dangerous enrollment rights; monitor 4886/4887 (cert requests/issues). Fix the template.
Delegation / relay (T1207): inventory unconstrained/RBCD delegation; enable SMB signing + LDAP channel binding/signing to kill NTLM relay; monitor for coercion (PetitPotam-style).
Structural hygiene: run PingCastle/BloodHound as the defender, tier admin accounts, Protected Users group, LAPS for local admin, and remove the attack-graph edges (see tradecraft-attack-path-mapping).

Gotchas

4769 fires constantly — key on RC4/volume/odd source, not the raw event.
Legacy apps may need RC4/unconstrained delegation; document exceptions, don't leave them silent.
ADCS is often the fastest domain-takeover path and the least monitored — prioritise it.

Verify success

A controlled roast/DCSync/ESC1 in a lab produces the expected event and alerts, and a BloodHound run shows the corresponding attack-graph edge removed after hardening.

References

Microsoft AD security docs; SpecterOps ADCS ("Certified Pre-Owned"); PingCastle; MITRE ATT&CK.

---name: defense-ad-defensedescription: Detect and harden against Active Directory attacks — Kerberoasting, AS-REP roasting, DCSync, ADCS abuse, and delegation/relay. Load for "detect kerberoasting", "harden AD", "AD monitoring", "did someone DCSync us", or defending a domain. The defensive counterpart to the ad-* offensive skills.---# Active Directory defense## When it appliesYou run an AD domain and need to catch the standard attacker toolkit and close the structural weaknessesit relies on — before or after a foothold.## Why it worksMost AD attacks abuse features, not bugs, so they leave predictable event signatures and depend onspecific misconfigurations. Watch the right events and remove the preconditions, and the commonpaths (the ones BloodHound finds) simply close.## Method1. **Kerberoasting (T1558.003)**: alert on Event `4769` (TGS request) with RC4 (`0x17`) encryption or high volume from one account. Harden: strong (25+ char) managed service-account passwords, gMSAs, and AES-only where possible.2. **AS-REP roasting (T1558.004)**: find and fix accounts with "do not require Kerberos preauth"; alert on `4768` without preauth.3. **DCSync (T1003.006)**: alert on `4662` replication GUIDs (DS-Replication-Get-Changes) from a principal that is not a DC. Harden: audit who holds replication rights.4. **ADCS (ESC1-8, T1649)**: audit templates for enrollee-supplied SAN + client-auth EKU (ESC1) and dangerous enrollment rights; monitor `4886/4887` (cert requests/issues). Fix the template.5. **Delegation / relay (T1207)**: inventory unconstrained/RBCD delegation; enable SMB signing + LDAP channel binding/signing to kill NTLM relay; monitor for coercion (PetitPotam-style).6. **Structural hygiene**: run PingCastle/BloodHound *as the defender*, tier admin accounts, Protected Users group, LAPS for local admin, and remove the attack-graph edges (see `tradecraft-attack-path-mapping`).## Gotchas- `4769` fires constantly — key on RC4/volume/odd source, not the raw event.- Legacy apps may need RC4/unconstrained delegation; document exceptions, don't leave them silent.- ADCS is often the fastest domain-takeover path and the least monitored — prioritise it.## Verify successA controlled roast/DCSync/ESC1 in a lab produces the expected event and alerts, and a BloodHound runshows the corresponding attack-graph edge removed after hardening.## ReferencesMicrosoft AD security docs; SpecterOps ADCS ("Certified Pre-Owned"); PingCastle; MITRE ATT&CK.

Frequently asked questions