ADscan runs an Active Directory assessment from one terminal: enumeration,
Kerberoasting, AS-REP roasting, AD CS abuse (ESC1 to ESC17), DCSync, RBCD,
shadow credentials, NTLM relay, credential dumping, and attack-path analysis
to Domain Admin. 104 techniques, each mapped to MITRE ATT&CK, listed here:
https://github.com/ADScanPro/adscan/blob/main/COVERAGE.md

Homepage: https://adscanpro.com
Source: https://github.com/ADScanPro/adscan
Install: pipx install adscan
License: Business Source License 1.1, Change Date 2029-02-01,
Change License Apache 2.0
Activity: releases roughly weekly, 0000386:0000500 stars, ~35k PyPI downloads

Two things I would rather settle before doing any packaging work.

First, the license. The policy asks whether the licensing allows free
redistribution. BSL 1.1 grants it in as many words: "the right to copy,
modify, create derivative works, redistribute, and make non-production use of
the Licensed Work". What it restricts is competing production use,
specifically offering the work to third parties on a hosted or embedded basis
against the paid version. Kali and its users can redistribute and use it at no
cost, and every version converts to Apache 2.0 on the Change Date. It is
source-available rather than OSI-approved, so I am not going to assume that
counts. Does it?

Second, packaging. ADscan currently ships as a PyPI launcher that runs the
scanner in a Docker image. A .deb would either pull that image on first run or
need the runtime repackaged natively. If a container dependency is a
non-starter, say so now and I will scope the native work before filing
anything else.

On your other criteria: it is built for internal AD assessments and lab work,
so the use case fits. On overlap, Kali already ships tools covering individual
steps ADscan performs; what it adds is chaining them and validating the path
end to end instead of reporting each step alone. If that is not enough
differentiation for you, fair enough. Resources are modest: Python plus the
runtime image, no GPU or special hardware, runs on a stock Kali with network
access to the target domain.

I maintain the project and will do the packaging work if the answers above go
the right way.