ADScanPro/Claude-AD

What it is

Claude-AD is a Claude Code plugin from ADScanPro that gives Claude a playbook for internal Active Directory assessments. It drives netexec, impacket, certipy, bloodyAD and BloodHound CE (Apache-2.0) rather than replacing them. The repo is MIT licensed. The same vendor sells ADscan, a separate automated product under Business Source License 1.1 (source-available), and the README points readers to it.

How it works

The plugin has three parts:

• Skills (eight): ad-methodology, ad-environment-constraints, ad-opsec-telemetry, kerberos-attacks, adcs-attacks, acl-abuse, coercion-ntlm-relay and compliance-mapping.
• Agents (three): ad-enumerator runs collection, ad-attack-planner reasons about low-privilege to Domain Admin paths, and ad-exploit-operator executes one step behind a human gate.
• Commands (three): /ad-scope, /ad-recon and /ad-attack-paths.

The skills load automatically when the work is an AD engagement. Each technique entry gives the standard command, the MITRE ID, the detection events and the fix. Every skill points to The Hacker Recipes for exact syntax. The compliance mapping is described as conceptual: it names the control family a technique touches in DORA, NIS2 and ENS, not audit-grade evidence.

What to do

Install from inside Claude Code:

/plugin marketplace add ADScanPro/Claude-AD
/plugin install claude-ad@claude-ad

The first line registers the repo as a marketplace and the second installs the plugin. Start with /ad-scope, then /ad-recon and /ad-attack-paths. The README does not document the commands' arguments or output.

Caveats

• Use is limited to your own lab, a contracted engagement or a CTF.
• Exploitation agents ask for confirmation before any directory-modifying action (password reset, group add, RBCD write) and note where rollback applies. Read-only steps are not stated to be gated.
• The README says you still drive each tool and read each result. Full automation with reporting and rollback is the paid-adjacent ADscan product, not this repo.
• The page gives no benchmarks, tool version requirements or test results for the plugin.
• Reviewing the compliance mapping before citing it is prudent, since the maintainers invite corrections to it.