Clone and install
Start from a clean local checkout, run the installer, and keep the virtual environment active for repeatable use.
AdStrikeInstall
Install AdStrike locally.
Prepare the environment, verify dependencies, and start the terminal console for authorized Active Directory assessments.
quick start
$ git clone https://github.com/capture0x/AdStrike.git
$ cd AdStrike
$ chmod +x install.sh run.sh
$ bash install.sh
$ source venv/bin/activate
$ bash run.sh
$ python3 main.py --check
Check dependencies
Run the built-in checker before an engagement so missing external tools are visible before you begin.
Configure target context
Set domain, controller, identity, and authentication mode once so modules can reuse the same assessment context.
Run the console
Use the interactive menu, Smart Analyst, AI operator mode, or MCP path depending on the workflow you want.
Before running
Prepare the environment before starting an assessment.
Python environment
Use the project virtual environment so AdStrike and its Python dependencies stay isolated from the system Python install.
External tooling
Several workflows depend on common AD assessment tools. Run the checker before testing so missing binaries are found early.
Authentication choice
AdStrike supports password, NT hash, and Kerberos-oriented workflows. Pick the mode that matches the engagement material you have.
Authorization boundary
Use the framework only inside systems you own or are explicitly authorized to assess. Keep scope and evidence organized per engagement.
Choose a mode
Start with the workflow that fits the engagement.
The install path is the same, but the way you operate AdStrike can change depending on whether you want manual control, AI assistance, artifact analysis, or MCP-driven operation.
Interactive console
Best when you want to choose modules manually from the numbered menu.
Smart Analyst
Best after collecting data and wanting a prioritized view of likely next steps.
AI operator
Best when you want assisted planning or full-auto operation with selected OPSEC behavior.
MCP client
Best when you want Claude Code, Cursor, or another MCP-capable client to drive structured actions.