Start here
- Use the tool: Install and inspect the CLI.
- Understand the output: Explore the assessment walkthrough.
- Evaluate support: Read the validation ledger.
- Build with Rust: Use the SDK or choose a protocol crate.
From signal to evidence
ADhammer is an open-source CLI for authorized Active Directory security assessments. It collects directory state, resolves control paths that end at Tier-0, and keeps the status of every result explicit: observed, validated with proof, or validation owed.
- Discover — collect directory services and exposure within scope.
- Map — follow relationships and possible paths to Tier-0.
- Validate — exercise supported paths with operator consent and recorded evidence.
- Report — carry results into JSON, HTML, Markdown, or BloodHound CE export.
Truth before theatre
ADhammer does not treat a possible path as proof. That distinction is the product: a report a defender can act on without guessing what was actually demonstrated.
| Signal | Meaning |
|---|---|
| Observed | A condition was collected from the assessment scope. |
| Validated | A supported path produced recorded proof. |
| Validation owed | Code or a possible path exists, but proof is not on file. |
The validation ledger is authoritative for support and readiness claims.
v1.5.0 / first-touch signal
Published 2026-09-04. Version 1.5.0 adds a documented first-touch workflow for authorized, in-scope environments: DNS SRV discovery, optional fingerprinting of AD-facing HTTP(S) services, and anonymous SMB posture collection where the target permits it. It also adds focused enumeration surfaces, a coercion-family matrix, and hashcat-mode guidance on roast output.
The release is available through GitHub Releases and crates.io. Static release builds have SHA-256 sidecars and GitHub OIDC Sigstore verification instructions. Exact feature scope and validation status remain linked to the changelog and ledger.
Quick start
One binary. No Python runtime. No sidecar service. Prebuilt release binaries are available for Linux, macOS, and Windows.
# Inspect the available assessment surface before using any live command.
# Review documented syntax for the passive audit workflow.
Use only systems you own or are explicitly authorized to test. Read the security policy, validation ledger, and release notes before an engagement.
What ships
| Surface | What it gives you |
|---|---|
| Directory assessment | LDAP collection, AD CS context, delegation, trust, hygiene, and posture analysis. |
| Attack-path graph | Directional control edges and the cheapest viable routes to Tier-0. |
| Evidence outputs | JSON, HTML, Markdown, and BloodHound CE export with findings, paths, and proof kept connected. |
| First-touch discovery | Documented scoped DNS, AD web-surface, and anonymous posture workflows in v1.5.0. |
| Rust ecosystem | Published icedracon protocol crates that can be consumed independently. |
For exact CLI syntax, capability boundaries, and the complete vector inventory,
use the command reference, adhammer --help, and the
validation ledger.
Security-signal boundary
ADhammer is native to Active Directory assessment: discovery, directory analysis, Tier-0 path mapping, supported validation, and report generation. It creates structured evidence for approved downstream workflows; it is not marketed as a SIEM, EDR, DLP platform, Sigma/YARA rule engine, general web-application scanner, or Android / APK testing suite.
| Domain | ADhammer’s role |
|---|---|
| SIEM / case workflow | Machine-readable JSON evidence for downstream CI, SIEM, and scoring pipelines — not a built-in vendor connector. |
| EDR / DLP | External controls. Authorized assessments may create observable protocol activity; ADhammer ships no evasion or endpoint-agent capability. |
| Sigma / YARA | Not shipped. Detection content belongs in the team’s approved detection-engineering workflow. |
| Web / APK pentest | Separate disciplines. ADhammer’s documented web capability targets AD-facing surfaces, not general application or mobile testing. |
Built for people who need proof
- Assessors: scoped AD reconnaissance, analysis, and supported validation.
- Defenders: findings that distinguish observed conditions, recorded proof, and validation still owed.
- Rust developers: reusable protocol crates and an SDK for integration.
The icedracon stack
ADhammer is the application layer on top of published, standalone Rust crates for Microsoft security protocols. Use the binary for an assessment, or adopt a single crate when you need a lower-level building block.
| Layer | Examples |
|---|---|
| Transport | dcerpc · smb2-client · ms-ndr |
| Directory / graph | adhammer-collector · adhammer-graph · bloodhound-export |
| Auth / crypto | ntlmssp · ms-pac-forge · dpapi-ng |
| AD CS / RPC | ms-icpr · ms-crtd · ms-drsr |
Each crate has its own maturity and validation status; publication alone does not establish production readiness.
Explore the wider ecosystem through icedracon's repositories and the SDK documentation.
Reference shelf
| Need | Go here |
|---|---|
| Release-specific change log | CHANGELOG.md |
| Support and validation state | docs/VALIDATION.md |
| Benchmark methodology and raw data | docs/BENCHMARKS.md |
| Security policy and reporting | SECURITY.md |
| Contributing guidance | CONTRIBUTING.md |
Authorized use
[!CAUTION] ADhammer implements security-assessment and validation capabilities that can affect production systems. Use it only against systems you own or are explicitly authorized to test.