01 ADAttack #11 — Golden Ticket Attack 2026-08-1002 ADAttack #25 — Shadow Credentials Attack (msDS-KeyCredentialLink) 2026-08-1003 ADAttack #26 — AdminSDHolder Persistence via ACL 2026-08-1004 ADAttack #36 — Certifried (CVE-2022-26923) 2026-08-1005 ADAttack #64 — Golden Ticket Persistence 2026-08-1006 ADAttack #65 — ACL Backdooring (Persistence via DCSync ACE) 2026-08-1007 ADAttack #67 — ADCS Certificate-Based Persistence 2026-08-1008 ADCertificate Persistence — Certifried (CVE-2022-26923) 2026-08-1009 ADDPERSIST2 — Rogue CA Certificate (NTAuth Injection) 2026-08-1010 ADDPERSIST3 — Malicious Misconfiguration (ACL Backdoor) 2026-08-1011 ADGolden Certificate Attack — DPERSIST1 2026-08-1012 DFIRLinux Forensics 2026-09-2613 ADPERSIST1 — Active User Credential Theft via Certificates 2026-08-1014 ADPERSIST2 — Machine Account Persistence via Certificates 2026-08-1015 ADPERSIST3 — Account Persistence via Certificate Renewal 2026-08-10

☧ CPTS · ordered posts

Locked

Unlock with your Main_Key through local GPG.

Start the local GPG helper

In your cheatsheet checkout, run:

npm run unlock:helper

Open the link it prints, or paste its pairing code below. Keep the terminal open until GPG finishes.

Import an index you already decrypted

Download the encrypted index, then decrypt with GPG:

gpg --output report-index.json --decrypt report-index.gpg

Your private key stays in GPG. The decrypted index is saved in this browser so you can reopen it after navigation, refreshes and restarts. Lock this browser or clear this site's browser data to remove the saved index. Nothing is uploaded.