Title	Tags
Account Operators	Active Directory Privilege Escalation Account Operators Credential Dumping LAPS Group Membership Abuse Evil-Winrm Powerview Windows Create User
AD Recycle Bin	Active Directory AD Recycle Bin Privilege Escalation Object Recovery Deleted Objects Restore Domain Controller Windows PowerShell
ADCS	Kerberos Pass-the-Ticket Certify Credential Dumping Ldap Pass-the-Hash Ticket Granting Ticket Domain Controller Certificate Services Active Directory Windows ADCS Pass-the-Cert Lookup SID
AddKeyCredentialLink	Shadow Credentials Pass-the-Cert AddkeyCredentialLink Active Directory Windows Whisker Pywhisker
AddMember	Powerview AddMember Domain Controller Active Directory Windows BloodyAD
AddSelf	Powerview Genericall AddMember Group Policy Domain Controller Addself Active Directory Windows BloodyAD
ADFS	SAML Token-Based Authentication ADFS Active Directory Windows Federation Services
ADIDNS	Domain ADIDNS ADDS DNS PowerMad DNS Posioning Spoofing Windows Active Directory
AllowedToDelegate	Pass-the-Ticket Silver Ticket Ticket Granting Ticket AllowedToDelegate Active Directory Windows AddAllowedtoAct AllowedToAct
Alternate Data Stream	File Metadata Alternate Data Stream ADS Windows Hidden Files
ASMI Bypass	ASMI Bypass ASMI Anti-Virus Windows
Azure AD Connect	Azure AD Connect Secretsdump ADSync Password Active Directory Windows
Azure Enum	Cloud Azure Password Spraying Enumeration Microsoft Windows Reconnaissance
Bloodhound	Bloodhound Sharphound Sliver Enumeration Active Directory Windows Neo4J DNS Dnschef Ldap Ldapsearch
Built-in Group	Built-in Group Windows Windows Service
Constrained Delegation	Credential Dumping Impacket Pass-the-Ticket Silver Ticket Ticket Granting Ticket Constrained Delegation Active Directory Windows RBCD KCD
Cross Session Relay	NTLM Pass-the-Hash Authentication Cross Session Relay Active Directory Windows Krbrelay Remotepotato0
Domain Trusts	Active Directory Privilege Escalation Domain Trusts Parent-Child Trust Kerberos Golden Ticket Mimikatz Rubeus Pass-the-Ticket Ticket Granting Ticket Credential Dumping Cross-Domain Attack Windows
Dotnet	Dotnet SDK C# Windows Compile .Net Programming
DPAPI	Credential Dumping Mimikatz DPAPI Windows Password Donpapi
ExecuteDCOM	Executedcom Active Directory Windows RCE
File Transfer (Linux to Windows)	Curl Http File Transfer File Transfer Windows Evil-Winrm IEX IWR Certutil
File Transfer (Windows To Linux)	SMB File System Mounting Http File Transfer Remote File Inclusion File Transfer Windows Evil-Winrm
File Transfer (Windows To Windows)	SMB File System Mounting Remote File Inclusion File Transfer Windows
Find (Windows)	File Metadata Hidden Files File Attributes Find Files Windows
Firewall (Windows)	Firewall Inbound Outbound Network Windows Access Control
ForceChangePassword	Forcechangepassword Powerview Active Directory Windows BloodyAD
GenericAll	Shadow Credentials Powerview Credential Dumping AddMember Impacket Genericall Domain Controller Active Directory Windows
GenericWrite	Shadow Credentials Pass-the-Ticket Kerberoasting Genericwrite Powerview Asreproast Credential Dumping Ticket Granting Ticket Active Directory Windows Disabled Account
GetChanges/GetChangesAll	Dcsync Getchanges Getchangesall Secretsdump Active Directory Windows
GPOs	GPOs Windows Group Policy Objects WriteGPLink
IIS	IIS Web Server Windows
IP Routing	Networking IPRouting Linux Windows Iproute2 Netsh PowerShell NetworkAdministration SystemAdministration Routing
Kerberoasting	Kerberos Impacket Kerberoasting Asreproast Rubeus Domain Controller Active Directory Windows GetNPUsers
Kerberos	Kerberos Pass-the-Ticket Hash Cracking Rubeus Password Cracking Sliver Enumeration NTLM SMB Kerbrute Pass-the-Hash Impacket Ticket Granting Ticket Domain Controller Active Directory Windows Krb5 Keytab SSSD
Krbrelayx	Dns Spoofing Krbrelayx Dnstools Active Directory Windows DNS NTLM
LDAP	Kerberos Ldap Nmap Ldap Search Enumeration Active Directory Windows Nxc Ldapmodify Ldif Permissions
LDAP Relay	Attack Chain NTLM Ldap Pass-the-Hash Impacket NTLM Replay Petitpotam Active Directory Windows WebDAV Ticket Granting Ticket RBCD Secretsdump
Machine Account	Kerberos Credential Dumping Pass-the-Ticket Rubeus Ticket Granting Ticket Domain Controller Machine Account Microsoft Virtual Account Active Directory Windows
Metasploit	Exploitation Post-Exploitation Searchsploit Metasploit Vulnerability Scanning Exploit Meterpreter Windows Msfconsole
Microsoft Access Database	Database Dumping Access Database Windows Mdb
Microsoft Oulook Email Folder	Outlook Email Windows Pst Ost Mbox
MSSQL Agent Jobs	Database Dumping Privilege Escalation in Databases MSSQL Database Windows Agent Jobs
MSSQL General	Database Dumping Privilege Escalation in Databases MSSQL Database Windows
MSSQL Linked Servers	Database Dumping Privilege Escalation in Databases MSSQL Database Windows Linked Server
MSSQL Privilege Escalation	Hash Cracking Privilege Escalation NTLM MSSQL Database Windows RCE Enum Domain Users SID NTLM Relay
NetExec (nxc)	Ldap Crackmapexec Rid Brute Force SMB Ldap Search Enumeration Domain Controller Nxc Active Directory Windows Winrm
NTLM Relay Attack	Shadow Credential NTLM Ldap Pass-the-Hash Impacket NTLM Replay Petitpotam Active Directory Windows ADCS WebDAV Pkinit Ticket Granting Ticket
Persistence	AddMember Account Windows Persistence
Phishing	Phishing Social Engineering Responder Phishing Campaigns Email Xll Excel Hta Shortcut Windows Odt Libre Vba NTLM Theft Pdf NTLM
Pre-Windows 2000 Computer	Domain Controller Pre-Windows 2000 Computer Active Directory Windows Pre2k Pre-Created Computer STATUS_PASSWORD_MUST_CHANGE
RBCD Attack	Pass-the-Ticket Pass-the-Hash Silver Ticket Ticket Granting Ticket Active Directory Windows RBCD Resource-Based Constrained Delegation S4U Impersonate Credential Dumping Genericall WriteAccountRestrictions SPN-Less
RDP	RDP Remote Desktop Windows Xfreerdp
ReadGMSAPassword	Credential Dumping ReadGMSApassword Gmsadumper Active Directory Windows
ReadLAPSPassword	Credential Dumping Powerview ReadLAPSpassword Active Directory Windows LAPS
Registry	Windows Registry Reg.exe Windows Internals Persistence COM Hijacking DLL Injection
RPC	Impacket Domain Controller Nxc Active Directory Windows Enumeration SID
Runas	PowerShell Credential Object Windows Runas UAC SavedCred Cmdkey
SCCM	SCCM System Center Configuration Manager Active Directory Windows Configuration Management
Scheduled tasks	Enumeration Scheduled Tasks Windows Enum
SeBackupPrivilege/SeRestorePrivilege	Credential Dumping File System SeBackupPrivilege SeRestorePrivilege Windows Backup Operators Diskshadow SAM SECURITY SYSTEM NTDS.DIT
Secrets Dump	SAM SYSTEM SECURITY Dcsync Impacket Secretsdump Domain Controller Credential Dumping Active Directory Windows NTDS.DIT Hive LAPS
Secure String	PowerShell Secure Strings Windows Decrypt
SeDebugPrivilege	SeDebugPrivilege Windows Metasploit Reverse Shell
SeEnableDelegationPrivilege	SeEnableDelegationPrivilege Pass-the-Ticket Service Ticket Ticket Granting Ticket Constrained Delegation Active Directory Windows KCD Secretsdump Unonstrained Delegation
SeImpresonate	SeImpresonate Windows Potato Privilege Escalation Fullpower Scheduled Tasks
SeLoadDriverPrivilege	Exploitation SeLoadDriverPrivilege Privilege Escalation Windows Reverse Shell
SeTcbPrivilege	SeTcbPrivilege Windows Privilege Escalation
Silver Ticket	Pass-the-Ticket SID Rubeus Ticket Granting Ticket Silver Ticket Sidhistory Domain Controller Active Directory Windows GetUserSPNs
SMB Enum	Kerberos Nmap SID Smbclient Mount Enumeration SMB Impacket Reconnaissance Windows ADS GPP Group Policy Preference SYSVOL
SMB Server	SMB Server File Transfer NTLM SMB Windows Share NET
Time Roasting	NTP Hash Cracking Time Roasting Enumeration Domain Controller Active Directory Windows
Unconstrained Delegation	Pass-the-Ticket S4U Ticket Granting Ticket Unconstrained Delegation Active Directory Windows PsExec
Volume Shadow Copies	Data Leakage Data Exfiltration Volume Shadow Copies Enumeration Windows VSC
WebDAV	Http File Transfer Curl WebDAV Http Web Enumeration WebClient Service Windows
Windows ACLs	Acls Icacls Windows Access Control Lists Files Permissions Encrypted File RunasCs
Windows Code Signing	Code Signing Executable Certificate CA Signtool Authenticode Digital Signature AppLocker Defender WDAC Windows
Windows Defender	Bypass Defender AV Anti-Virus Windows
Windows Event Logs	Forensics Evtx Event Logs Windows DIFR
Windows Processes	Processes Tasklist Dll Services Monitor Background Tasks Windows
Windows RPC	Impacket Windows RPC Windows COM Enumeration
Windows Services	Server Operators Active Directory Windows Privilege Escalation Services Reverse Shell Unquoted Service Path
Winrm	Kerberos Pass-the-Hash RCE Evil-Winrm Windows Pass-the-Ticket Pass-the-Cert Winrm PsExec AtExec
Winrm from Windows VM	Kerberos Pass-the-Ticket Domain Http File Transfer Authentication Ticket Granting Ticket Domain Controller Winrm Pssession Windows File Transfer Active Directory
WriteDacl	Writedacl Dcsync Powerview Credential Dumping Active Directory Windows
WriteOwner/Own	WriteOwner Permissions Powerview Impacket AddMember Domain Controller Active Directory Windows Dacledit Own
WriteSPN	WriteSPN Targeted Kerberoast Domain Controller Active Directory Windows