The Active Directory
attack reference.

The objects, protocols and stores an attacker reasons over: directory structure, Kerberos flow, NTLM, and where the secrets live.

Getting authentication material out of the domain: roasting, replication, and reusing hashes, keys, tickets and certs.

Once you hold a signing secret, forge tickets offline: Golden, Silver, Diamond, and SID-history injection.

Unconstrained, constrained and resource-based delegation misconfigurations that turn into impersonation and privilege escalation.

Force a machine to authenticate, then relay it: PetitPotam, the printer bug, mitm6/WPAD, and Kerberos relay.

Active Directory Certificate Services misconfigurations — the ESC1–ESC15 family — that mint authentication certificates.

Abusing DACLs on directory objects and GPOs — GenericAll, WriteDACL, WriteOwner — to walk edges toward Domain Admin.

Winning the box: low-priv shell → local admin/SYSTEM via UAC, tokens, services, tasks, pipes, DLLs and PATH, plus the Potato family — and keeping it.

Turning credentials into code execution across hosts: SMB, WMI, WinRM, PSRemoting and RDP.

Durable footholds once you own the domain: DCShadow, Skeleton Key, AdminSDHolder and DSRM backdoors.

Attacking the deployment plane: SCCM/MECM network access accounts and WDS/MDT imaging shares.

Crossing the domain and forest boundary: SID filtering, TREAT_AS_EXTERNAL and trust-key abuse.

The defender's side: tiering baselines, honeytokens and the log artifacts each technique leaves behind.

How an engagement actually runs: the kill-chain arc, situational awareness, C2/pivoting and staying quiet.

Reading and building Windows binaries: the PE format, shellcode, API hashing, packing, injection, and the static + dynamic analysis workflow.

Running C2 and staying quiet: beaconing, Cobalt Strike, AMSI/ETW evasion, and the Sysmon/Sigma detection they're built against.