Artificial Intelligence (AI) in Cybersecurity, Part 28: Using ADStrike to Compromise Active Directory

What it is

ADStrike (repo capture0x/AdStrike) is an Active Directory attack tool with 52 integrated attack modules and selectable OPSEC levels. An LLM is optional. When enabled, it reads the output of each step, decides which tool to run next, and chooses what information to look for. The page names Qwen 2.5-coder 7b as an example, and says any model that supports tool calls can be used. The author compares it to their earlier ADScan and ADPulse article. Those tools use Python libraries and need no AI.

How it works

The orchestrator starts at Recon and selects only the phases and steps that fit the environment. Attacks the infrastructure can't support are skipped. The page shows these steps:

• LAPS check: the result was empty because LAPS wasn't deployed in the lab.
• Kerberoasting: a few roastable accounts were found. Whether they are compromised depends on your wordlist.
• Timeroasting: uses an impacket script to extract computer hashes. The author calls these essentially impossible to brute force.
• Pre2k: some computers have a password matching their DNS name. NetExec is used to pass the computer name and password to the DC to find a valid account.
• BloodHound: runs SharpHound collection and has the AI analyze the data for attack paths and worthwhile accounts.

At the end it generates a report in several formats. The HTML version includes MITRE ATT&CK coverage and detailed findings.

Preconditions / Affected

• The demo used a regular, unprivileged domain account in a lab.
• Ollama is needed for local models. The tool detects installed models and lets you pick one.
• The page runs it on Kali.

What to do

Install and run, as given on the page:

git clone https://github.com/capture0x/AdStrike.git && cd AdStrike && chmod +x install.sh run.sh && bash install.sh && source venv/bin/activate && bash run.sh

• Setup takes about 5 minutes. You are then prompted for domain details, which are saved to a config file.
• Each phase's steps can be run individually from the main menu.
• Menu step 53 is the AI mode. The author kept the default OPSEC level.
• If you don't want an AI executing commands in your environment, use it for planning only, or skip it.

Defensive takeaways the page mentions:

• Deploy LAPS. It prevents lateral movement by giving each machine a different local Administrator password.
• Pre2k-style computer accounts can carry privileges, so check them in BloodHound.

Caveats

• The author's assessment is that the tool "looks very promising". This was a single lab run, with no benchmarks or comparison against running it without the AI.
• The page doesn't say how reliable the 7B model's decisions are. It doesn't describe what the OPSEC levels change, or give detection guidance.
• The tool actively attacks the domain. Run it only against environments you are authorized to test, and review install.sh before running the one-liner, since it executes install scripts from a third-party repo.