0c) or forge it manually — keys from trust-sid-history (5b: secretsdump -just-trust-keys, impacket master only, else mimikatz)

1) automated child→parent (nxc module — DCSyncs the child krbtgt, forges the EA ticket; intra-forest only)

1) automated child→parent (nxc module — DCSyncs the child krbtgt, forges the EA ticket; intra-forest only) — via PtH

1) back up the CA key → CA.pfx

1) back up the CA key → CA.pfx — with NT hash

1) create the rogue machine (name WITHOUT $ — it becomes {{computer_name}}$)

1) create the rogue machine (name WITHOUT $ — it becomes {{computer_name}}$) — via PtH

1) dump with the ticket from step 0 (nxc additionally needs local admin for RemoteOperations)

1) get the agent / any-purpose cert

1) get the agent / any-purpose cert — with NT hash

1) make yourself officer (Manage CA)

1) make yourself officer (Manage CA) — with NT hash

1b) cross-domain: create it in the partner domain via Kerberos (KRB5CCNAME = your extra-SID ticket)

2) forge a cert for any identity

2) point the DC machine account at your rogue machine (trustee WITH $)

2) point the DC machine account at your rogue machine (trustee WITH $) — via PtH

2) publish SubCA (Manage CA)

2) publish SubCA (Manage CA) — with NT hash

2) request on behalf of the target

2) request on behalf of the target — with NT hash

2) same straight to DRSUAPI (Kerberos needs the DNS name → {{trust_dc_fqdn}})

2b) cross-domain variant via Kerberos

3) or: partner creds that hold DCSync rights there

3) or: partner creds that hold DCSync rights there — with NT hash

3) request SubCA (fails → saves the key)

3) request SubCA (fails → saves the key) — with NT hash

3) S4U2Proxy as {{target_user}} on the DC (HOST SPN)

3b) cross-domain: realm = partner domain, machine creds

3c) nxc alternative: authenticate as the rogue machine, nxc runs S4U2Self+S4U2Proxy internally

3d) same and dump NTDS as {{target_user}} in one go

4) approve request ID (replace from step 3)

4) approve request ID (replace from step 3) — with NT hash

4) machine identity variant (-dns)

4) same via PtH

5) DCSync the DC with the impersonated admin ticket

5) retrieve the issued cert

5) retrieve the issued cert — with NT hash

5) single account: the partner krbtgt key

5) single account: the partner krbtgt key — with NT hash

5b) or plain SAM/LSA dump from the DC

6) forge inter-realm golden with AES256 — -extra-sid = target-domain SIDs as ONE comma-separated list; -user-id = real RID of the ticketer username ({{user_rid}} when you forge as {{user}}; default 500 = Administrator)

6b) same with extra PAC (ly4k fork only)

6c) RC4 fallback — outgoing key, only valid while both trust directions share the password (< 30 days)

6d) cross-forest with SID history enabled (Treat as External): RID 500–1000 is filtered, only RID > 1000 survives — pick a group like Exchange Windows Permissions or a custom admin group

A: cleanup

A: cleanup — via PtH

A: crack (no proxy)

A: password variant

A: password variant — via PtH

A: targeted kerberoast — set SPN (your notes style)

A) inject Client Authentication (Schannel)

A) inject Client Authentication (Schannel) — with NT hash

A) LDAPS shell as the target

Abuse MachineAccountQuota to Add Computer Account

Abuse RBCD

Abuse SCCM HTTP client enrollment

Access Remote Files

account data for password calc (low-priv AD read)

Acquire a Let's Encrypt Certificate for a C2 Domain

Active ARP Host Discovery

Active ARP Scan of Subnet

Active Directory collection

Active Directory Relay Audit (Ghost SPNs Suppressed)

Active DNS Resolution of Discovered Hosts

Active host discovery

Active host discovery

Active ICMP Ping Sweep

active sessions on a host

active sessions on a host — via PtH

AD DNS records

AD DNS records — via PtH

AD_Miner - AD-miner

ADCS web enrollment variant (works with LDAP signing enforced)

ADCS web enrollment variant (works with LDAP signing enforced) — via PtH

Add a C# type to the current session

Add a domain user to local Administrators with NT hash (computer GPO)

Add a domain user to local Administrators with password (computer GPO)

Add a dynamic DNS record

add a machine account (password is printed)

Add a Shadow Credential

Add a User to a Domain Group

Add an Authorized Host to AWX Inventory

Add an existing account to a local group

Add Computer Startup Script via GPO

Add Custom Outlook Form

Add KeePass Config Trigger

add local admin (cleanup later)

add local admin (cleanup later) — via PtH

Add Local Administrator via GPO

add member to group

add member to group — via PtH

add member via ccache

Add Remote Registry Backdoor

add self

add self — via PtH

add self via ccache

Add Shadow Credential

Add SID history value (x64 builds)

Add Source-NAT Traffic Interaction

Add trustee ACE to remote registry keys

Add User Logon Script via GPO

add/overwrite A record

add/overwrite A record — via PtH

adidnsdump - adidnsdump

admin-style reset

admin-style reset — via PtH

AdminService console — with NT hash

AdminService console (get_creds/decrypt/speak_to_the_manager/script)

AES-only domains (module defaults to RC4)

AES-only domains (module defaults to RC4) — via PtH

AES256 key (preferred when available — works in AES-only domains)

after SPN redirect: ticket for the DC

agent cert via ccache

all delegation (impacket)

all delegation (impacket) — with NT hash

all delegation edges (unconstrained + constrained + RBCD, enabled accounts only)

all delegation edges (unconstrained + constrained + RBCD, enabled accounts only) — via PtH

all delegation via ccache (env inline)

all domain hashes offline

all groups

all groups of the partner domain

all hashes (password)

all hashes (password) — with NT hash

all my write rights in the partner domain

all recon tables

all TGS via ccache (env inline)

all vectors → uncon host

all vectors → uncon host — with NT hash

all vectors, list only

all vectors, list only — with NT hash

all writable objects

all writable objects — via PtH

all writable objects via ccache

allow Restricted Admin (needs local admin)

allow Restricted Admin (needs local admin) — via PtH

also escalate user

alternative automation (impacket)

alternative automation (impacket) — with NT hash

alternative: raw minidump (parse with pypykatz)

alternative: raw minidump (parse with pypykatz) — via PtH

altservice for local admin services

altservice for local admin services — with NT hash

altservice trick

altservice trick with NT hash

altservice variant (your notes)

AlwaysInstallElevatedCheck

analysis mode (see traffic first)

Analyze an Existing KeePass Memory Dump

Analyze Credential Guard VMware Snapshot

Analyze Credential Guard VMware Snapshot

Analyze Local Binary with Defender Engine

Analyze Local Name-Resolution Traffic

Analyze Local Script or Payload with AMSI Engine

Analyze Remote URL Payload with Defender Engine

Analyze Windows system information

Anonymous Bind Directory Enumeration

anonymous RootDSE over LDAPS (636)

anonymous RootDSE over LDAPS (636)

Append saved signature data to a test PE

Apply Default BGInfo Configuration

Apply One-Time Extension Remapping

Apply Saved Configuration

Approve WSUS Update for Client

Archive and Exfiltrate .env File

Archive Directory Contents Without the Root Folder

ARP Cache Poisoning

ARP Poisoning MITM (authorized lab)

ARP spoofing (authorized MITM validation)

AS-REP against the trusted domain

AS-REP Roasting from a supplied user list (no credentials)

AS-REP Roasting via authenticated LDAP enumeration

AS-REP Roasting via authenticated LDAP enumeration

AS-REQ roast, no creds (4768 instead of 4769)

Assign installed Host to company (Linux)

Assign installed Host to company (macOS)

Assign installed Host to company (Windows)

Assign User Rights via GPO

atexec (scheduled task)

atexec (scheduled task) — with NT hash

atexec.py - proxychains

Attach and Load a Script through Python Bindings

Attach and Load a Script through Python Bindings

Attach to a 64-bit process by PID

Attach to Process

Audit a remote SMS Provider

Audit an authorized hash file with wordlist mode

Audit authorized hashes with a wordlist

Audit authorized hashes with configured wordlist rules

Audit dMSA creation permissions

Audit the local SMS Provider

auth with explicit identity override

Authenticate and identify mapped account (C#)

Authenticate and identify mapped account (Python)

Authenticate User Credentials via Winbind

Authenticate User Credentials via Winbind

Authenticate with an approved certificate

Authenticate with an approved certificate

Authenticate with AppRole

Authenticate with device code

Authenticate with Private Key Identity

Authenticate with username and password

Authenticated Directory Dump via Simple Bind

Authorize Security Group Ingress

Authorized TSIG-Authenticated Zone Transfer

AutoLogon credentials

AutoLogon credentials — via PtH

AutologonCheck

Automated Database Enumeration

Automated Database Enumeration

Automated NoPAC Exploitation

B: redirect delegation SPN to the DC (your notes)

B) inject Certificate Request Agent

B) inject Certificate Request Agent — with NT hash

Back up a Kubernetes Namespace

Back up an authorized certification authority

Back up an authorized certification authority

Backdoor Mode

Banner Grabbing

Banner Grabbing

base64 password → MD4 = NT hash → PtH

Basic Host Reachability Check

Basic OneDrive User Enumeration

Basic OneDrive User Enumeration

BloodHound CE collector (newer package name)

BloodHound CE collector (newer package name) — with NT hash

bloodyAD - Active Directory Trust Enumeration

bloodyAD - Certifried

bloodyAD - Cross-domain Kerberoasting

bloodyAD - DSRM Account Persistence

bloodyAD - RBCD via NTLM Relay

bloodyAD alternative (no $ in name)

bloodyAD alternative (no $ in name) — via PtH

bloodyAD gMSA read

bloodyAD gMSA read — via PtH

bloodyAD LAPS read

bloodyAD LAPS read — via PtH

bloodyAD read

bloodyAD read — via PtH

bloodyAD resolve SD

bloodyAD resolve SD — via PtH

bloodyAD variant

bloodyAD variant — computer: use $

bloodyAD variant — computer: use $ — via PtH

bloodyAD variant — via PtH

bloodyAD variant (ccache/pfx output)

bloodyAD variant (ccache/pfx output) — via PtH

Browse an accessible SMB share

Browse and access SMB shares

browser cookies

browser cookies — via PtH

Brute Force RDP Credentials

Brute Force SSH

Brute Force SSH Credentials

Brute-Force MS-RPC Interface UUIDs and Opnums

Brute-Force Subdomain Enumeration

Bruteforce Single User Password

Build .NET Assembly Loader

Build a scoped wordlist

Build a scoped wordlist

Build Active Directory Object Cache

Build Obfuscated XLM Macro Workbook

Build PE Loader

Build Raw-Shellcode Loader

Bulk Enumerate Azure AD Users from File

Bulk Enumerate Azure AD Users with Login Method

bulk via stdin

bulk: all computers of the domain

bulk: all partner computers you pwned

bulk: every enabled partner user you own

bulk: every enabled user (e.g. spray success lists)

Bypass EDR User-Mode Hooks

Call a Rundll32-Compatible DLL Entry Point

Capture authorized 802.11 traffic

Capture Desktop Screenshot

Capture DNS Traffic on Port 53

Capture DNS transport traffic

Capture Events with a Saved Process-Name Filter

Capture Network Traffic to File

Capture one authorized web application

Capture packets to a PCAP file

Capture Proxy Authentication

Capture Screen with ScreenshotBOF

Capture Screen with ScreenshotBOF (1.0)

Capture Screen with ScreenshotBOF (1.1, Beacon file return)

Capture Screen with ScreenshotBOF (1.2)

Capture Traffic on Specific Interface

Capture URLs from an authorized list

Capture WPA Handshake Frames for an Authorized AP

ccache

ccache exec

ccache only via Restricted Admin (server must allow it)

ccache variant of your original getST

Certipy - certipy

certipy (auto: add, auth, clear)

certipy (auto: add, auth, clear) — with NT hash

certipy via ccache

certipy: -k -no-pass (env inline)

certsync - certsync

certutil download

certutil download — via PtH

Change a DOM node's displayed text

Change an Account Password

Check a candidate SharePoint site URL

Check a known SharePoint site URL

Check a SharePoint site URL response

Check a synthetic session with a scoped cookie jar

Check a synthetic session with a scoped cookie jar

Check a username

Check a VNC password file

Check an OpenVPN credential

Check an RDP credential

Check an SSH private key

Check and Stop Interfering Processes

Check Benign Upload Retrieval

Check Breach Status

Check Bucket List

Check Bucket Permissions

Check Candidate Email Breach Status

Check Configuration and Lure URLs

Check default WSUS and web ports

check delegation + T2A4D flag (0x1000000)

check delegation + T2A4D flag (0x1000000) — via PtH

Check device compliance

Check domain categories

Check ESXi Host Client HTTPS response

Check File and Directory Access

check for missing RPC encryption enforcement

check for missing RPC encryption enforcement — with NT hash

Check for signature data

Check Gophish Admin HTTPS Listener

check if the domain still allows the BadSuccessor path

check if the domain still allows the BadSuccessor path — via PtH

Check Interfering Processes

Check LDAP Signing and LDAPS Channel Binding

check MachineAccountQuota

check MachineAccountQuota — via PtH

Check MDI Instance Deployment via Autodiscover Heuristic

check membership

check membership — via PtH

Check Microsoft Defender status (read-only)

Check Nextcloud login route

Check one authorized Tomcat Manager credential

Check one authorized Tomcat Manager credential

Check one test credential across listed endpoints

check RDP and NLA status

check RDP and NLA status — with NT hash

Check Remote WebClient Service

Check the hostapd control interface

Check the local RDP listener

Check vCenter for CVE-2021-21972

check via ccache

Check WSUS Update Status

check your rights on a protected group

check your rights on a protected group — via PtH

chronyc makestep

CLEANUP

CLEANUP

CLEANUP

CLEANUP — via PtH

CLEANUP — via PtH

CLEANUP (nxc): remove all key credentials

CLEANUP — with NT hash

CLEANUP: clear the plugin

CLEANUP: clear the plugin — via PtH

CLEANUP: delete computer

CLEANUP: delete computer — via PtH

CLEANUP: delete the dMSA

CLEANUP: delete the dMSA — via PtH

CLEANUP: delete the machine account

CLEANUP: delete the machine account

CLEANUP: delete the machine account — with NT hash

CLEANUP: delete the rogue machine

CLEANUP: disable again

CLEANUP: disable again — via PtH

CLEANUP: flush all

CLEANUP: flush all — with NT hash

CLEANUP: flush RBCD

CLEANUP: push the original value back, then /push

CLEANUP: remove key credential

CLEANUP: remove key credential — with NT hash

CLEANUP: remove RBCD

CLEANUP: remove RBCD — via PtH

CLEANUP: remove record

CLEANUP: remove record — via PtH

CLEANUP: remove SPN from DC