16 pages
Other
Pages not yet filed under a section.
Page Kind Tags Updated
BloodHound Collection OPSEC
quiet SharpHound tradecraft
C2 & Pivoting in AD
operating from the foothold
Certificate Mapping
strong vs weak; ESC9/ESC10
Certificate Templates
the ESC1-4 surface
Defense Evasion for AD Tooling
EDR / AMSI / ETW
ESC1
enrollee-supplied SAN on a client-auth template
ESC2
Any Purpose / no-EKU template
ESC3
Certificate Request Agent (enroll on behalf of)
ESC4
writable certificate-template ACL
ESC6
EDITF_ATTRIBUTESUBJECTALTNAME2 (CA-wide SAN)
NTAuthCertificates
the forest client-auth trust store
OPSEC Tradecraft for AD Ops
operating without tripping the SOC
PKI & AD CS Architecture
CA, templates, enrollment
Red-Team AD Methodology
the operational kill-chain
Situational Awareness
post-foothold AD recon
Ticket & Credential Handling
engagement hygiene
16 pages in this section