Perform DCSync attacks by abusing MS-DRSR replication rights (DS-Replication-Get-Changes/-All) to impersonate a Domain Controller and extract KRBTGT, Domain Admin, and service account hashes for Golden Ticket forging, typically with Mimikatz.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-domain-persistence-with-dcsyncnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-domain-persistence-with-dcsync -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-domain-persistence-with-dcsync -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/conducting-domain-persistence-with-dcsyncgh skill install mukul975/Anthropic-Cybersecurity-Skills conducting-domain-persistence-with-dcsyncgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/conducting-domain-persistence-with-dcsync ~/.claude/skills/conducting-domain-persistence-with-dcsync # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/conducting-domain-persistence-with-dcsync ~/.agents/skills/conducting-domain-persistence-with-dcsync # Codex, Cursor, Gemini CLI, Copilot, OpenCode