01 ADAttack #11 — Golden Ticket Attack 2026-08-1002 ADAttack #12 — Silver Ticket Attack 2026-08-1003 ADAttack #13 — Diamond Ticket Attack 2026-08-1004 ADAttack #14 — Sapphire Ticket Attack 2026-08-1005 ADAttack #15 — Unconstrained Delegation Abuse 2026-08-1006 ADAttack #21 — WriteDACL Abuse 2026-08-1007 ADAttack #22 — WriteOwner Abuse 2026-08-1008 ADAttack #24 — AllExtendedRights DCSync ACE Abuse 2026-08-1009 ADAttack #26 — AdminSDHolder Persistence via ACL 2026-08-1010 ADAttack #33 — ESC8 NTLM Relay to ADCS HTTP Endpoint 2026-08-1011 ADAttack #34 — ESC11 NTLM Relay to ADCS RPC 2026-08-1012 ADAttack #36 — Certifried (CVE-2022-26923) 2026-08-1013 ADAttack #37 — DCSync Attack 2026-08-1014 ADAttack #38 — DCShadow Attack 2026-08-1015 ADAttack #39 — NTDS.dit Extraction and Dumping 2026-08-1016 ADAttack #41 — PetitPotam (CVE-2021-36942) 2026-08-1017 ADAttack #43 — PrintNightmare (CVE-2021-34527) 2026-08-1018 ADAttack #53 — Exchange Windows Permissions (WriteDACL to DCSync) 2026-08-1019 ADAttack #60 — Token Stealing and Impersonation 2026-08-1020 ADAttack #64 — Golden Ticket Persistence 2026-08-1021 ADAttack #65 — ACL Backdooring (Persistence via DCSync ACE) 2026-08-1022 ADAttack #68 — Cross-Domain Trust Abuse (SID History) 2026-08-1023 ADAttack #69 — Forest Trust Abuse Cross-Forest Ticket Forging 2026-08-1024 ADAttack #73 — gMSA Password Extraction 2026-08-1025 ADAttack #74 — Azure AD Connect Credential Extraction 2026-08-1026 ADAttack #9 — mitm6 (IPv6 DNS Spoofing DHCPv6 Takeover) 2026-08-1027 ADCertificate Persistence — Certifried (CVE-2022-26923) 2026-08-1028 ADESC8 — NTLM Relay to ADCS HTTP Web Enrollment 2026-08-1029 ENUMgit-dumper 2026-10-1130 ADImpacket dpapi 2026-10-1131 CREDkpcli & keepassxc-cli 2026-10-1132 ADPERSIST2 — Machine Account Persistence via Certificates 2026-08-1033 ADTHEFT3 — Machine Certificate Theft via DPAPI 2026-08-10