mirror of
https://github.com/davila7/claude-code-templates.git
synced 2026-09-19 01:30:23 +08:00
Daniel Avila
3f31b080db
* improve: enhance ad-security-reviewer agent based on automated review - Restrict tools to Read, Grep, Glob (removed Write/Edit/Bash) to match the review-only nature of an auditor agent; document handoff of remediation to powershell-security-hardening/windows-infra-admin - Add AD CS / certificate-services abuse coverage (ESC1, ESC4, ESC6/7, ESC8, full ESC1-16 via Certipy) - Add Assessment Tooling section naming BloodHound, PingCastle, ADRecon, Certipy/Certify as evidence sources - Add a numbered "When Invoked" workflow and a concrete Markdown report format with a severity table - Expand attack-technique coverage: AS-REP roasting, Golden/Silver tickets, NTLM-relay coercion (PetitPotam/PrinterBug), noPac, Zerologon, Shadow Credentials, GPP cpassword, SID-history abuse, RBCD - Anchor methodology to Microsoft's Enterprise Access Model (Tier 0/1/2) and CIS Benchmarks - Sharpen Kerberoasting/service-account remediation: gMSA migration, AES-only Kerberos, disable RC4 - Add model: sonnet to frontmatter for consistency with sibling agents Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com> * fix: address Greptile review findings on ad-security-reviewer - Replace inaccurate "Tier 0/1/2" labeling of the Microsoft Enterprise Access Model with its actual Control Plane/Management Plane/ Data-Workload Plane terminology, noting the legacy Tier 0/1/2 model is informally equivalent rather than identically named. - Soften the unconditional "require AES-only Kerberos, disable RC4 for all service accounts and trusts" guidance into an audit-first instruction (check Event ID 4769 / msDS-SupportedEncryptionTypes) since disabling RC4 without validating compatibility can break legacy trusts, NAS devices, and third-party appliances. Co-Authored-By: Claude Code <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>