> For the complete documentation index, see [llms.txt](https://viperone.gitbook.io/pentest-everything/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory.md).

# Everything Active Directory and Windows

- [Active Directory Enumeration](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/ad-enumeration.md)
- [ADCS](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adcs.md)
- [Enumeration - Certificate Authority](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adcs/enumeration-certificate-authority.md)
- [ESC1](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adcs/esc1.md)
- [ESC2](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adcs/esc2.md)
- [ESC3](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adcs/esc3.md)
- [ESC4](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adcs/esc4.md)
- [ESC6](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adcs/esc6.md)
- [ESC7](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adcs/esc7.md)
- [ESC8](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adcs/esc8.md)
- [ESC9 - WIP](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adcs/esc9-wip.md)
- [ESC11](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adcs/esc11.md)
- [Access Token Manipultion](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/access-token-manipultion.md): https://attack.mitre.org/techniques/T1134/
- [Token Impersonation](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/access-token-manipultion/token-impersonation.md): https://attack.mitre.org/techniques/T1134/001/
- [Create Process with Token](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/access-token-manipultion/create-process-with-token.md): https://attack.mitre.org/techniques/T1134/002/
- [Make and Impersonate Token](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/access-token-manipultion/make-and-impersonate-token.md): https://attack.mitre.org/techniques/T1134/003/
- [Parent PID Spoofing](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/access-token-manipultion/parent-pid-spoofing.md): https://attack.mitre.org/techniques/T1134/004/
- [SID-History Injection](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/access-token-manipultion/sid-history-injection.md): https://attack.mitre.org/techniques/T1134/005/
- [Adversary-in-the-Middle](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adversary-in-the-middle.md): https://attack.mitre.org/techniques/T1557/
- [LDAP Relay](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adversary-in-the-middle/ldap-relay.md)
- [LLMNR](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adversary-in-the-middle/llmnr.md)
- [RDP MiTM](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adversary-in-the-middle/rdp-mitm.md)
- [SMB Relay](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adversary-in-the-middle/smb-relay.md)
- [Credential Access](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access.md)
- [Brute Force](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/brute-force.md)
- [Password Spraying](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/brute-force/password-spraying.md): https://attack.mitre.org/techniques/T1110/003/
- [Credential Dumping](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/credential-dumping.md): https://attack.mitre.org/techniques/T1003/
- [LSASS Memory](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/credential-dumping/lsass-memory.md): https://attack.mitre.org/techniques/T1003/001/
- [Security Account Manager (SAM)](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/credential-dumping/security-account-manager-sam.md): https://attack.mitre.org/techniques/T1003/002/
- [NTDS](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/credential-dumping/ntds.md): https://attack.mitre.org/techniques/T1003/003/
- [LSA Secrets](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/credential-dumping/lsa-secrets.md): https://attack.mitre.org/techniques/T1003/004/
- [Cached Domain Credentials](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/credential-dumping/cached-domain-credentials.md): https://attack.mitre.org/techniques/T1003/005/
- [DCSync](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/credential-dumping/dcsync.md): https://attack.mitre.org/techniques/T1003/006/
- [DCSync Attack](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/credential-dumping/dcsync/dcsync-attack.md)
- [Credentials from Password Stores](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/credentials-from-password-stores.md): https://attack.mitre.org/techniques/T1555/
- [Credentials from Web Browsers](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/credentials-from-password-stores/credentials-from-web-browsers.md): https://attack.mitre.org/techniques/T1555/003/
- [Windows Credential Manager](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/credentials-from-password-stores/windows-credential-manager.md): https://attack.mitre.org/techniques/T1555/004/
- [Unsecured Credentials](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/unsecured-credentials.md): https://attack.mitre.org/techniques/T1552/
- [Credentials In Files](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/unsecured-credentials/credentials-in-files.md): https://attack.mitre.org/techniques/T1552/001/
- [Credentials in Registry](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/unsecured-credentials/credentials-in-registry.md): https://attack.mitre.org/techniques/T1552/002/
- [Group Policy Preferences](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/unsecured-credentials/group-policy-preferences.md): https://attack.mitre.org/techniques/T1552/006/
- [GPP Passwords](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/unsecured-credentials/group-policy-preferences/gpp-password.md)
- [Modify Authentication Process](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/modify-authentication-process.md): https://attack.mitre.org/techniques/T1556/
- [Domain Controller Authentication: Skeleton Key](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/modify-authentication-process/domain-controller-authentication-skeleton-key.md): https://attack.mitre.org/techniques/T1556/001/
- [Reversible Encryption](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/modify-authentication-process/reversible-encryption.md): https://attack.mitre.org/techniques/T1556/005/
- [Steal or Forge Kerberos Tickets](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/steal-or-forge-kerberos-tickets.md): https://attack.mitre.org/techniques/T1558/
- [AS-REP Roasting](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/steal-or-forge-kerberos-tickets/as-rep-roasting.md): https://attack.mitre.org/techniques/T1558/004/
- [Golden Ticket](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/steal-or-forge-kerberos-tickets/golden-ticket.md): https://attack.mitre.org/techniques/T1558/001/
- [Kerberoasting](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/steal-or-forge-kerberos-tickets/kerberoasting.md): https://attack.mitre.org/techniques/T1558/003/
- [Silver Ticket](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/steal-or-forge-kerberos-tickets/silver-ticket.md): https://attack.mitre.org/techniques/T1558/002/
- [S4U2Self](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/steal-or-forge-kerberos-tickets/s4u2self.md)
- [Ticket Aquisition](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/steal-or-forge-kerberos-tickets/ticket-aquisition.md)
- [Constrained Delegation](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/steal-or-forge-kerberos-tickets/constrained-delegation.md)
- [Unconstrained Delegation](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/steal-or-forge-kerberos-tickets/unconstrained-delegation.md)
- [Collection](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/collection.md)
- [Clipboard Data](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/collection/clipboard-data.md): https://attack.mitre.org/techniques/T1115/
- [Audio Capture](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/collection/audio-capture.md): https://attack.mitre.org/techniques/T1123/
- [Defense Evasion](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/defense-evasion.md)
- [Disable and Bypass Defender](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/defense-evasion/disable-defender.md)
- [Impair Defenses](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/defense-evasion/impair-defenses.md): https://attack.mitre.org/techniques/T1562/
- [Disable Windows Event Logging](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/defense-evasion/impair-defenses/disable-windows-event-logging.md): https://attack.mitre.org/techniques/T1562/002/
- [Impair Command History Logging](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/defense-evasion/impair-defenses/impair-command-history-logging.md): https://attack.mitre.org/techniques/T1562/003/
- [Disable or Modify System Firewall](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/defense-evasion/impair-defenses/disable-or-modify-system-firewall.md): https://attack.mitre.org/techniques/T1562/004/
- [Indicator Removal](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/defense-evasion/indicator-removal.md): https://attack.mitre.org/techniques/T1070/
- [Clear Windows Event Logs](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/defense-evasion/indicator-removal/clear-windows-event-logs.md): https://attack.mitre.org/techniques/T1070/001/
- [Clear Command History](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/defense-evasion/indicator-removal/clear-command-history.md): https://attack.mitre.org/techniques/T1070/003/
- [File Deletion](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/defense-evasion/indicator-removal/file-deletion.md): https://attack.mitre.org/techniques/T1070/004/
- [Network Share Connection Removal](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/defense-evasion/indicator-removal/network-share-connection-removal.md): https://attack.mitre.org/techniques/T1070/005/
- [Timestomp](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/defense-evasion/indicator-removal/timestomp.md): https://attack.mitre.org/techniques/T1070/006/
- [Input Capture](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/input-capture.md): https://attack.mitre.org/techniques/T1056/
- [Keylogging](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/input-capture/keylogging.md): https://attack.mitre.org/techniques/T1562/004/
- [Lateral Movement](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/lateral-movement.md)
- [PowerShell Remoting](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/lateral-movement/lateral-movement.md)
- [Alternate Authentication Material](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/lateral-movement/alternate-authentication-material.md): https://attack.mitre.org/techniques/T1550/
- [Pass The Hash](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/lateral-movement/alternate-authentication-material/wip-pass-the-hash.md): https://attack.mitre.org/techniques/T1550/002/
- [Pass the Ticket](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/lateral-movement/alternate-authentication-material/wip-pass-the-ticket.md): https://attack.mitre.org/techniques/T1550/003/
- [Pass the Password](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/lateral-movement/alternate-authentication-material/pass-the-password.md)
- [File Execution Methods](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/file-execution-methods.md)
- [File Transfer Techniques](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/file-transfer-techniques.md)
- [Forced Coercion](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/forced-coercion.md)
- [URL File Attack](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/forced-coercion/url-file-attack.md)
- [LAPS](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/laps.md)
- [Network Sniffing](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/network-sniffing.md): https://attack.mitre.org/techniques/T1040/
- [Persistence](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/persistence.md)
- [AdminSDHolder](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/persistence/adminsdholder.md)
- [BITS Jobs](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/persistence/bits-jobs.md): https://attack.mitre.org/techniques/T1197/
- [Create Account](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/persistence/create-account.md): https://attack.mitre.org/techniques/T1136/
- [Local Account](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/persistence/create-account/local-account.md): https://attack.mitre.org/techniques/T1136/001/
- [Domain Account](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/persistence/create-account/domain-account.md): https://attack.mitre.org/techniques/T1136/002/
- [Cloud Account](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/persistence/create-account/cloud-account.md): https://attack.mitre.org/techniques/T1136/003/
- [Create or Modify System Process](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/persistence/create-or-modify-system-process.md): https://attack.mitre.org/techniques/T1543/003/
- [Windows Service](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/persistence/create-or-modify-system-process/windows-service.md): https://attack.mitre.org/techniques/T1543/003/
- [Custom SSP](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/persistence/custom-ssp.md)
- [DSRM](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/persistence/dsrm.md)
- [Persistence Notes](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/persistence/persistence.md)
- [Skeleton Key Attack](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/persistence/skeleton-key-attack.md)
- [Privilege Escalation](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/privilege-escalation.md)
- [Privilege Escalation Checklist](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/privilege-escalation/privilege-escalation-checklist.md)
- [DnsAdmin](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/privilege-escalation/dnsadmin.md)
- [Registry](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/privilege-escalation/registry.md)
- [Always Install Elevated](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/privilege-escalation/registry/registry-alwaysinstallelevated.md)
- [AutoRuns](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/privilege-escalation/registry/autoruns.md)
- [Service Exploits](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/privilege-escalation/service-exploits.md)
- [Insecure Service Permissions](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/privilege-escalation/service-exploits/insecure-service-permissions.md)
- [SCCM / MECM](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/sccm-mecm.md)
- [Recon](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/sccm-mecm/recon.md)
- [CRED-1 - PXE Abuse](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/sccm-mecm/cred-1-pxe-abuse.md)
- [CRED-2 - Policy Request Credentials](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/sccm-mecm/cred-2-policy-request-credentials.md)
- [CRED-3 - WMI Local Secrets](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/sccm-mecm/cred-3-wmi-local-secrets.md)
- [CRED-4 - CIM Repository](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/sccm-mecm/cred-4-cim-repository.md)
- [CRED-5 - MSSQL Database](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/sccm-mecm/cred-5-mssql-database.md)
- [ELEVATE-2 - Client Push](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/sccm-mecm/elevate-2-client-push.md)
- [TAKEOVER-2](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/sccm-mecm/takeover-2.md)
- [Timeroasting](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/timeroasting.md)
- [Tools](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/tools.md)
- [BloodHound](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/tools/bloodhound.md)