Lateral Movement

Pass-the-Certificate

Abuse stolen X.509 certificates to authenticate via PKINIT or SChannel, obtaining TGTs or session tokens without requiring plaintext credentials.

Remote Execution in Active Directory

Techniques for executing commands on remote AD hosts via WMI, PsExec, WinRM, and scheduled tasks to facilitate lateral movement across the domain.

DCOM Lateral Movement

Explores abusing Windows DCOM interfaces for lateral movement in AD environments, executing remote code via MMC20, ShellWindows, and ShellBrowserWindow objects.

Pass-the-Hash and Pass-the-Ticket

Explores credential-based lateral movement techniques in AD, covering PtH NTLM relay attacks and PtT Kerberos ticket hijacking to traverse network boundaries.

Pass-the-Ticket and Overpass-the-Hash

Covers Kerberos-based lateral movement via stolen TGTs (Pass-the-Ticket) and NTLM-to-TGT abuse (Overpass-the-Hash) in Active Directory environments.