01 ^: 10 sheets
Credential Access
01 advanced Attack #1 — Password Spraying 2026-08-10 02 advanced Attack #2 — Kerberoasting 2026-08-10 03 advanced Attack #3 — AS-REP Roasting 2026-08-10 04 advanced Attack #4 — Pass-the-Hash (PtH) 2026-08-10 05 advanced Attack #5 — Pass-the-Ticket (PtT) 2026-08-10 06 advanced Attack #6 — Overpass-the-Hash (Pass-the-Key) 2026-08-10 07 advanced Attack #7 — NTLM Relay Attacks 2026-08-10 08 advanced Attack #8 — LLMNR NBT-NS mDNS Poisoning 2026-08-10 09 advanced Attack #9 — mitm6 (IPv6 DNS Spoofing DHCPv6 Takeover) 2026-08-10 10 advanced Attack #10 — Credential Hunting in Shares GPP Passwords 2026-08-10
02 ^: 10 sheets
Kerberos & Delegation
01 advanced Attack #11 — Golden Ticket Attack 2026-08-10 02 advanced Attack #12 — Silver Ticket Attack 2026-08-10 03 advanced Attack #13 — Diamond Ticket Attack 2026-08-10 04 advanced Attack #14 — Sapphire Ticket Attack 2026-08-10 05 advanced Attack #15 — Unconstrained Delegation Abuse 2026-08-10 06 advanced Attack #16 — Constrained Delegation Abuse (S4U2Proxy) 2026-08-10 07 advanced Attack #17 — Resource-Based Constrained Delegation (RBCD) 2026-08-10 08 advanced Attack #18 — Bronze Bit Attack (CVE-2020-17049) 2026-08-10 09 intermediate Kerberoasting 2026-08-09 10 advanced Kerberoasting — Local On-Host 2026-08-10
03 ^: 8 sheets
ACL Abuse
01 advanced Attack #19 — GenericAll Abuse 2026-08-10 02 advanced Attack #20 — GenericWrite Abuse 2026-08-10 03 advanced Attack #21 — WriteDACL Abuse 2026-08-10 04 advanced Attack #22 — WriteOwner Abuse 2026-08-10 05 advanced Attack #23 — ForceChangePassword Abuse 2026-08-10 06 advanced Attack #24 — AllExtendedRights DCSync ACE Abuse 2026-08-10 07 advanced Attack #25 — Shadow Credentials Attack (msDS-KeyCredentialLink) 2026-08-10 08 advanced Attack #26 — AdminSDHolder Persistence via ACL 2026-08-10
04 ^: 41 sheets
ADCS & Certificates
01 advanced Attack #27 — ESC1 SAN Specification in Template 2026-08-10 02 advanced Attack #28 — ESC2 Any Purpose EKU No EKU 2026-08-10 03 advanced Attack #29 — ESC3 Certificate Request Agent 2026-08-10 04 advanced Attack #30 — ESC4 Template Write Permissions 2026-08-10 05 advanced Attack #31 — ESC6 EDITF_ATTRIBUTESUBJECTALTNAME2 Flag 2026-08-10 06 advanced Attack #32 — ESC7 Vulnerable CA Officer Permissions 2026-08-10 07 advanced Attack #33 — ESC8 NTLM Relay to ADCS HTTP Endpoint 2026-08-10 08 advanced Attack #34 — ESC11 NTLM Relay to ADCS RPC 2026-08-10 09 advanced Attack #35 — Golden Certificate Attack 2026-08-10 10 advanced Attack #36 — Certifried (CVE-2022-26923) 2026-08-10 11 advanced ESC1 — SAN Specification in Template 2026-08-10 12 advanced ESC2 — Any Purpose EKU No EKU (The Swiss Certificate) 2026-08-10 13 advanced ESC3 — Misconfigured Enrollment Agent Templates 2026-08-10 14 advanced ESC4 — Vulnerable Certificate Template Access Control 2026-08-10 15 advanced ESC5 — Vulnerable PKI Object Access Control 2026-08-10 16 advanced ESC6 — EDITF_ATTRIBUTESUBJECTALTNAME2 Flag 2026-08-10 17 advanced ESC7 — Vulnerable CA Access Control (ManageCA ManageCertificates) 2026-08-10 18 advanced ESC8 — NTLM Relay to ADCS HTTP Web Enrollment 2026-08-10 19 advanced ESC9 — No Security Extension (Template-Level) 2026-08-10 20 advanced ESC10 — Weak Certificate Mapping 2026-08-10 21 advanced ESC11 — NTLM Relay to ADCS RPC (ICPR) 2026-08-10 22 advanced ESC12 — Shell Access to CA with YubiHSM 2026-08-10 23 advanced ESC13 — Issuance Policy OID Group Link 2026-08-10 24 advanced ESC14 — Weak Explicit Certificate Mapping 2026-08-10 25 advanced ESC15 — EKUwu (CVE-2024-49019) 2026-08-10 26 advanced ESC16 — Security Extension Disabled on CA (Globally) 2026-08-10 27 advanced ESC17 — ADCS Certificate Spoofing to Attack HTTPS-Enabled WSUS Clients 2026-08-10 28 advanced PERSIST1 — Active User Credential Theft via Certificates 2026-08-10 29 advanced PERSIST2 — Machine Account Persistence via Certificates 2026-08-10 30 advanced PERSIST3 — Account Persistence via Certificate Renewal 2026-08-10 31 advanced THEFT1 — Exporting Certificates and Keys 2026-08-10 32 advanced THEFT2 — User Certificate Theft via DPAPI 2026-08-10 33 advanced THEFT3 — Machine Certificate Theft via DPAPI 2026-08-10 34 advanced THEFT4 — Finding Certificate Files 2026-08-10 35 advanced THEFT5 — NTLM Theft via PKINIT (UnPAC-the-Hash) 2026-08-10 36 advanced DPERSIST2 — Rogue CA Certificate (NTAuth Injection) 2026-08-10 37 advanced DPERSIST3 — Malicious Misconfiguration (ACL Backdoor) 2026-08-10 38 advanced ADCS Attack Methodology 2026-08-09 39 advanced Certificate Persistence — Certifried (CVE-2022-26923) 2026-08-10 40 advanced Golden Certificate Attack — DPERSIST1 2026-08-10 41 advanced Shadow Credentials — msDS-KeyCredentialLink Abuse 2026-08-10
05 ^: 8 sheets
Domain Controller Attacks
01 advanced Attack #37 — DCSync Attack 2026-08-10 02 advanced Attack #38 — DCShadow Attack 2026-08-10 03 advanced Attack #39 — NTDS.dit Extraction and Dumping 2026-08-10 04 advanced Attack #40 — Zerologon (CVE-2020-1472) 2026-08-10 05 advanced Attack #41 — PetitPotam (CVE-2021-36942) 2026-08-10 06 advanced Attack #42 — PrinterBug SpoolSample 2026-08-10 07 advanced Attack #43 — PrintNightmare (CVE-2021-34527) 2026-08-10 08 advanced Attack #44 — noPAC Sam-the-Admin (CVE-2021-42278 42287) 2026-08-10
06 ^: 9 sheets
Privilege & Group Abuse
01 advanced Attack #45 — Token Impersonation (SeImpersonatePrivilege) 2026-08-10 02 advanced Attack #46 — DNSAdmins DLL Injection 2026-08-10 03 advanced Attack #47 — MachineAccountQuota (MAQ) Abuse 2026-08-10 04 advanced Attack #48 — GPP Password Decryption 2026-08-10 05 advanced Attack #49 — Abusing Backup Operators Group 2026-08-10 06 advanced Attack #50 — Abusing Account Operators Group 2026-08-10 07 advanced Attack #51 — Abusing Server Operators Group 2026-08-10 08 advanced Attack #52 — Abusing Print Operators Group 2026-08-10 09 advanced Attack #53 — Exchange Windows Permissions (WriteDACL to DCSync) 2026-08-10
07 ^: 8 sheets
Lateral Movement
01 advanced Attack #54 — PsExec Remote Execution via SMB 2026-08-10 02 advanced Attack #55 — WinRM Evil-WinRM Lateral Movement 2026-08-10 03 advanced Attack #56 — RDP Lateral Movement and Hijacking 2026-08-10 04 advanced Attack #57 — DCOM Lateral Movement 2026-08-10 05 advanced Attack #58 — WMI Lateral Movement 2026-08-10 06 advanced Attack #59 — SCM Service Manager Lateral Movement 2026-08-10 07 advanced Attack #60 — Token Stealing and Impersonation 2026-08-10 08 intermediate Run as Another User from an Evil-WinRM Session 2026-08-29
08 ^: 7 sheets
Persistence
01 advanced Attack #61 — Skeleton Key Attack 2026-08-10 02 advanced Attack #62 — DSRM Backdoor Abuse 2026-08-10 03 advanced Attack #63 — SID History Injection 2026-08-10 04 advanced Attack #64 — Golden Ticket Persistence 2026-08-10 05 advanced Attack #65 — ACL Backdooring (Persistence via DCSync ACE) 2026-08-10 06 advanced Attack #66 — Malicious GPO Creation 2026-08-10 07 advanced Attack #67 — ADCS Certificate-Based Persistence 2026-08-10
09 ^: 4 sheets
Trust Abuse
10 ^: 7 sheets
Advanced & Post-Exploitation
01 advanced Attack #72 — LAPS Password Extraction 2026-08-10 02 advanced Attack #73 — gMSA Password Extraction 2026-08-10 03 advanced Attack #74 — Azure AD Connect Credential Extraction 2026-08-10 04 advanced Attack #75 — SCCM MECM Exploitation 2026-08-10 05 advanced Attack #76 — MSSQL Server and Linked Server Abuse 2026-08-10 06 advanced Attack #77 — DFSCoerce MS-DFSNM Coercion 2026-08-10 07 advanced Attack #78 — AD Recycle Bin Object Abuse 2026-08-10
11 ^: 22 sheets
Tooling & Recon
01 advanced Active Directory Attack Methodology 2026-08-09 02 intermediate Active-Directory_cheat_sheet 2026-08-10 03 advanced AD Pentest Tools Workflow 2026-08-09 04 intermediate Autobloody 2026-08-11 05 intermediate BloodHound 2026-08-09 06 intermediate bloodhound-ce-python 2026-08-10 07 intermediate BloodHound-Python_ 2026-08-10 08 intermediate BloodyAD 2026-08-09 09 advanced Certipy 2026-08-09 10 intermediate Certipy-ad 2026-08-10 11 intermediate faketime 2026-08-10 12 intermediate Impacket 2026-08-09 13 beginner Kerbrute 2026-08-09 14 intermediate LDAP Enumeration 2026-08-09 15 intermediate LDAP Search 2026-08-10 16 intermediate ldapdomaindump 2026-08-10 17 intermediate Mimikatz 2026-08-09 18 intermediate NetExec (nxc) 2026-08-09 19 advanced PowerView and PowerUp Deep-Dive 2026-08-29 20 advanced Rubeus 2026-08-09 21 intermediate RustHound-CE 2026-09-13 22 intermediate SharpHound_ 2026-08-10