Active Directory:

Lateral Movement

PTH, PTT, DCOM, and remote exec methods for AD lateral movement

5 guides • Created Apr 5, 2026 • Updated Aug 11, 2026

5 guides

Pass-the-Certificate

Abuse stolen X.509 certificates to authenticate via PKINIT or SChannel, obtaining TGTs or session tokens without requiring plaintext credentials.

Jun 11, 2026 • 4 min read

Remote Execution in Active Directory

Techniques for executing commands on remote AD hosts via WMI, PsExec, WinRM, and scheduled tasks to facilitate lateral movement across the domain.

Apr 30, 2026 • 4 min read

DCOM Lateral Movement

Explores abusing Windows DCOM interfaces for lateral movement in AD environments, executing remote code via MMC20, ShellWindows, and ShellBrowserWindow objects.

Apr 30, 2026 • 3 min read

Pass-the-Hash and Pass-the-Ticket

Explores credential-based lateral movement techniques in AD, covering PtH NTLM relay attacks and PtT Kerberos ticket hijacking to traverse network boundaries.

Apr 30, 2026 • 5 min read

Pass-the-Ticket and Overpass-the-Hash

Covers Kerberos-based lateral movement via stolen TGTs (Pass-the-Ticket) and NTLM-to-TGT abuse (Overpass-the-Hash) in Active Directory environments.

Jul 1, 2026 • 4 min read

Lateral movement in AD uses captured credentials and tickets to reach additional hosts and domains. Pass-the-hash, pass-the-ticket, and overpass-the-hash convert local loot into remote access without cracking passwords.

Remote execution through WMI, PSExec, DCOM, and WinRM gives you shells on machines where your current credentials are valid. Trust abuse lets you move between domains and forests when bidirectional or misconfigured trusts exist.

Credential reuse across domains is common in environments with shared service accounts or identical local admin passwords. Each new host expands your credential pool and attack surface.