Title	Tags
Azure AD Connect	Azure AD Connect Secretsdump ADSync Password Active Directory Windows
Azure Enum	Cloud Azure Password Spraying Enumeration Microsoft Windows Reconnaissance
Unconstrained Delegation	Pass-the-Ticket S4U Ticket Granting Ticket Unconstrained Delegation Active Directory Windows Psexec
Abuse Parent Child Domain Trusts	Kerberos Pass-the-Ticket Rubeus Domain Trust Golden Ticket Silver Ticket Credential Dumping Trust Relationship Mimikatz Pass-the-Hash Ticket Granting Ticket Domain Controller Active Directory Windows
Account Operators	Credential Dumping AddMember Account Operators Active Directory Windows LAPS
AD Recycle Bin	Domain Controller AD Recycle Bin Active Directory Windows
ADCS	Kerberos Pass-the-Ticket Certify Credential Dumping Ldap Pass-the-Hash Ticket Granting Ticket Domain Controller Certificate Services Active Directory Windows ADCS Pass-the-Cert
AddKeyCredentialLink	Shadow Credentials Pass-the-Cert AddkeyCredentialLink Active Directory Windows Whisker Pywhisker
AddMember	Powerview AddMember Domain Controller Active Directory Windows BloodyAD
AddSelf	Powerview Genericall AddMember Group Policy Domain Controller Addself Active Directory Windows BloodyAD
ADFS	SAML Token-Based Authentication ADFS Active Directory Windows Federation Services
ADIDNS	Domain ADIDNS ADDS DNS PowerMad DNS Posioning Spoofing Windows Active Directory
AllowedToDelegate	Pass-the-Ticket Silver Ticket Ticket Granting Ticket Allowedtodelegate Active Directory Windows
Alternate Data Stream	File Metadata Alternate Data Stream ADS Windows Hidden Files
Bloodhound	Bloodhound Sharphound Sliver Enumeration Active Directory Windows Neo4J
Built-in Group	Built-in Group Windows Windows Service
Bypass ASMI	ASMI Anti-Virus Windows
Constrained Delegation	Credential Dumping Impacket Pass-the-Ticket Silver Ticket Ticket Granting Ticket Constrained Delegation Active Directory Windows RBCD
Cross Session Relay	Ntlm Pass-the-Hash Authentication Cross Session Relay Active Directory Windows Krbrelay Remotepotato0
dotnet	Dotnet SDK C# Windows Compile .Net
DPAPI	Credential Dumping Mimikatz DPAPI Windows Password Donpapi
ExecuteDCOM	Executedcom Active Directory Windows RCE
File Transfer (Linux to Windows)	Curl Http File Transfer File Transfer Windows Evil-Winrm IEX IWR Certutil
File Transfer (Windows To Linux)	Smb File System Mounting Http File Transfer Remote File Inclusion File Transfer Windows Evil-Winrm
File Transfer (Windows To Windows)	Smb File System Mounting Remote File Inclusion File Transfer Windows
Find (Windows)	File Metadata Hidden Files File Attributes Find Files Windows
Firewall (Windows)	Firewall Inbound Outbound Network Windows
ForceChangePassword	Forcechangepassword Powerview Active Directory Windows BloodyAD
GenericAll	Shadow Credentials Powerview Credential Dumping AddMember Impacket Genericall Domain Controller Active Directory Windows
GenericWrite	Shadow Credentials Pass-the-Ticket Kerberoasting Genericwrite Powerview Asreproast Credential Dumping Ticket Granting Ticket Active Directory Windows
GetChanges/GetChangesAll	Dcsync Getchanges Getchangesall Secretsdump Active Directory Windows
GPOs	GPOs Windows Group Policy Objects WriteGPLink
IIS	IIS Web Server Windows
Kerberoasting	Kerberos Impacket Kerberoasting Asreproast Rubeus Domain Controller Active Directory Windows GetNPUsers
Kerberos	Kerberos Pass-the-Ticket Hash Cracking Rubeus Password Cracking Sliver Enumeration Ntlm Smb Kerbrute Pass-the-Hash Impacket Ticket Granting Ticket Domain Controller Active Directory Windows
Krbrelayx	Dns Spoofing Krbrelayx Dnstools Active Directory Windows DNS Ntlm
LDAP	Kerberos Ldap Nmap Ldap Search Enumeration Active Directory Windows Nxc
Machine Account	Kerberos Credential Dumping Pass-the-Ticket Rubeus Ticket Granting Ticket Domain Controller Machine Account Microsoft Virtual Account Active Directory Windows
Metasploit	Exploitation Post-Exploitation Searchsploit Metasploit Vulnerability Scanning Exploit Meterpreter Windows Msfconsole
Microsoft Access Database	Database Dumping Access Database Windows Mdb
Microsoft Oulook Email Folder	Outlook Email Windows Pst Ost Mbox
Monitor Process (Windows)	Monitor Process Background Tasks Windows
MSSQL Agent Jobs	Database Dumping Privilege Escalation in Databases Mssql Database Windows Agent Jobs
MSSQL General	Database Dumping Privilege Escalation in Databases Mssql Database Windows
MSSQL Linked Servers	Database Dumping Privilege Escalation in Databases Mssql Database Windows Linked Server
MSSQL Privilege Escalation	Hash Cracking Database Dumping Privilege Escalation in Databases Ntlm Mssql Database Windows RCE Enum
NetExec (nxc)	Ldap Crackmapexec Rid Brute Force Smb Ldap Search Enumeration Domain Controller Nxc Active Directory Windows Winrm
NTLM Relay Attack	Shadow Credentials Attack Chain Ntlm Ldap Pass-the-Hash Impacket Ntlmreplay Petitpotam Active Directory Windows ADCS Webdav Pkinit Ticket Granting Ticket
Persistence	AddMember Account Windows Persistence
Phishing	Phishing Social Engineering Responder Phishing Campaigns Email Xll Excel Hta Shortcut Windows Odt Libre Vba Ntlm_Theft Pdf Ntlm
RBCD Attack	Pass-the-Ticket Pass-the-Hash Silver Ticket Ticket Granting Ticket Active Directory Windows RBCD Resource-Based Constrained Delegation S4U Impersonate Credential Dumping
RDP	RDP Remote Desktop Windows
ReadGMSAPassword	Credential Dumping ReadGMSApassword Gmsadumper Active Directory Windows
ReadLAPSPassword	Credential Dumping Powerview ReadLAPSpassword Active Directory Windows LAPS
RPC	Impacket Domain Controller Nxc Active Directory Windows Enumeration SID
Runas	Powershell Credential Object Windows Runas
SCCM	SCCM System Center Configuration Manager Active Directory Windows Configuration Management
Scheduled tasks	Enumeration Scheduled Tasks Windows Enum
SeBackupPrivilege/SeRestorePrivilege	Credential Dumping File System SeBackupPrivilege SeRestorePrivilege Windows Backup Operators Diskshadow
secretsdump	Sam Dcsync Impacket Domain Controller Credential Dumping Active Directory Windows Ntds.Dit Hive Nxc
Secure String	Powershell Secure Strings Windows Decrypt
SeDebugPrivilege	SeDebugPrivilege Windows Metasploit Reverse Shell
SeImpresonate	SeImpresonate Windows Potato Privilege Escalation Fullpower Scheduled Tasks
SeLoadDriverPrivilege	Exploitation SeLoadDriverPrivilege Privilege Escalation Windows Reverse Shell
Silver Ticket	Pass-the-Ticket SID Rubeus Ticket Granting Ticket Silver Ticket Sidhistory Domain Controller Active Directory Windows GetUserSPNs
SMB Enum	Kerberos Nmap SID Smbclient Mount Enumeration Smb Impacket Reconnaissance Windows ADS
SMB Server	Smbclient File Transfer Windows Ntlm
Volume Shadow Copies	Data Leakage Data Exfiltration Volume Shadow Copies Enumeration Windows VSC
Windows ACLs	Acls Icacls Windows Access Control Lists Files
Windows Defender	Bypass Defender AV Anti-Virus Windows
Windows Event Logs	Forensics Evtx Event Logs Windows DIFR
Windows RPC	Impacket Windows RPC Windows COM Enumeration
Windows Services	Server Operators Active Directory Windows Privilege Escalation Services Reverse Shell Unquoted Service Path
Winrm	Kerberos Pass-the-Hash RCE Evil-Winrm Windows Pass-the-Ticket Pass-the-Cert Winrm Psexec
Winrm from Windows VM	Kerberos Pass-the-Ticket Domain Http File Transfer Authentication Ticket Granting Ticket Domain Controller Winrm Pssession Windows File Transfer Active Directory
WriteDacl	Writedacl Dcsync Powerview Credential Dumping Active Directory Windows
WriteOwner/Own	Writeowner Permissions Powerview Impacket AddMember Domain Controller Active Directory Windows Dacledit