# Everything Active Directory and Windows

- [Active Directory Enumeration](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/ad-enumeration.md)
- [ADCS](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adcs.md)
- [Enumeration - Certificate Authority](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adcs/enumeration-certificate-authority.md)
- [ESC1](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adcs/esc1.md)
- [ESC2](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adcs/esc2.md)
- [ESC3](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adcs/esc3.md)
- [ESC4](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adcs/esc4.md)
- [ESC6](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adcs/esc6.md)
- [ESC7](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adcs/esc7.md)
- [ESC8](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adcs/esc8.md)
- [ESC9 - WIP](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adcs/esc9-wip.md)
- [ESC11](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adcs/esc11.md)
- [Access Token Manipultion](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/access-token-manipultion.md): https://attack.mitre.org/techniques/T1134/
- [Token Impersonation](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/access-token-manipultion/token-impersonation.md): https://attack.mitre.org/techniques/T1134/001/
- [Create Process with Token](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/access-token-manipultion/create-process-with-token.md): https://attack.mitre.org/techniques/T1134/002/
- [Make and Impersonate Token](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/access-token-manipultion/make-and-impersonate-token.md): https://attack.mitre.org/techniques/T1134/003/
- [Parent PID Spoofing](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/access-token-manipultion/parent-pid-spoofing.md): https://attack.mitre.org/techniques/T1134/004/
- [SID-History Injection](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/access-token-manipultion/sid-history-injection.md): https://attack.mitre.org/techniques/T1134/005/
- [Adversary-in-the-Middle](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adversary-in-the-middle.md): https://attack.mitre.org/techniques/T1557/
- [LDAP Relay](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adversary-in-the-middle/ldap-relay.md)
- [LLMNR](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adversary-in-the-middle/llmnr.md)
- [RDP MiTM](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adversary-in-the-middle/rdp-mitm.md)
- [SMB Relay](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adversary-in-the-middle/smb-relay.md)
- [Credential Access](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access.md)
- [Brute Force](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/brute-force.md)
- [Password Spraying](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/brute-force/password-spraying.md): https://attack.mitre.org/techniques/T1110/003/
- [Credential Dumping](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/credential-dumping.md): https://attack.mitre.org/techniques/T1003/
- [LSASS Memory](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/credential-dumping/lsass-memory.md): https://attack.mitre.org/techniques/T1003/001/
- [Security Account Manager (SAM)](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/credential-dumping/security-account-manager-sam.md): https://attack.mitre.org/techniques/T1003/002/
- [NTDS](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/credential-dumping/ntds.md): https://attack.mitre.org/techniques/T1003/003/
- [LSA Secrets](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/credential-dumping/lsa-secrets.md): https://attack.mitre.org/techniques/T1003/004/
- [Cached Domain Credentials](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/credential-dumping/cached-domain-credentials.md): https://attack.mitre.org/techniques/T1003/005/
- [DCSync](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/credential-dumping/dcsync.md): https://attack.mitre.org/techniques/T1003/006/
- [DCSync Attack](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/credential-dumping/dcsync/dcsync-attack.md)
- [Credentials from Password Stores](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/credentials-from-password-stores.md): https://attack.mitre.org/techniques/T1555/
- [Credentials from Web Browsers](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/credentials-from-password-stores/credentials-from-web-browsers.md): https://attack.mitre.org/techniques/T1555/003/
- [Windows Credential Manager](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/credentials-from-password-stores/windows-credential-manager.md): https://attack.mitre.org/techniques/T1555/004/
- [Unsecured Credentials](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/unsecured-credentials.md): https://attack.mitre.org/techniques/T1552/
- [Credentials In Files](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/unsecured-credentials/credentials-in-files.md): https://attack.mitre.org/techniques/T1552/001/
- [Credentials in Registry](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/unsecured-credentials/credentials-in-registry.md): https://attack.mitre.org/techniques/T1552/002/
- [Group Policy Preferences](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/unsecured-credentials/group-policy-preferences.md): https://attack.mitre.org/techniques/T1552/006/
- [GPP Passwords](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/unsecured-credentials/group-policy-preferences/gpp-password.md)
- [Modify Authentication Process](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/modify-authentication-process.md): https://attack.mitre.org/techniques/T1556/
- [Domain Controller Authentication: Skeleton Key](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/modify-authentication-process/domain-controller-authentication-skeleton-key.md): https://attack.mitre.org/techniques/T1556/001/
- [Reversible Encryption](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/modify-authentication-process/reversible-encryption.md): https://attack.mitre.org/techniques/T1556/005/
- [Steal or Forge Kerberos Tickets](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/steal-or-forge-kerberos-tickets.md): https://attack.mitre.org/techniques/T1558/
- [AS-REP Roasting](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/steal-or-forge-kerberos-tickets/as-rep-roasting.md): https://attack.mitre.org/techniques/T1558/004/
- [Golden Ticket](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/steal-or-forge-kerberos-tickets/golden-ticket.md): https://attack.mitre.org/techniques/T1558/001/
- [Kerberoasting](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/steal-or-forge-kerberos-tickets/kerberoasting.md): https://attack.mitre.org/techniques/T1558/003/
- [Silver Ticket](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/steal-or-forge-kerberos-tickets/silver-ticket.md): https://attack.mitre.org/techniques/T1558/002/
- [S4U2Self](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/steal-or-forge-kerberos-tickets/s4u2self.md)
- [Ticket Aquisition](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/steal-or-forge-kerberos-tickets/ticket-aquisition.md)
- [Constrained Delegation](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/steal-or-forge-kerberos-tickets/constrained-delegation.md)
- [Unconstrained Delegation](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/steal-or-forge-kerberos-tickets/unconstrained-delegation.md)
- [Collection](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/collection.md)
- [Clipboard Data](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/collection/clipboard-data.md): https://attack.mitre.org/techniques/T1115/
- [Audio Capture](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/collection/audio-capture.md): https://attack.mitre.org/techniques/T1123/
- [Defense Evasion](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/defense-evasion.md)
- [Disable and Bypass Defender](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/defense-evasion/disable-defender.md)
- [Impair Defenses](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/defense-evasion/impair-defenses.md): https://attack.mitre.org/techniques/T1562/
- [Disable Windows Event Logging](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/defense-evasion/impair-defenses/disable-windows-event-logging.md): https://attack.mitre.org/techniques/T1562/002/
- [Impair Command History Logging](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/defense-evasion/impair-defenses/impair-command-history-logging.md): https://attack.mitre.org/techniques/T1562/003/
- [Disable or Modify System Firewall](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/defense-evasion/impair-defenses/disable-or-modify-system-firewall.md): https://attack.mitre.org/techniques/T1562/004/
- [Indicator Removal](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/defense-evasion/indicator-removal.md): https://attack.mitre.org/techniques/T1070/
- [Clear Windows Event Logs](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/defense-evasion/indicator-removal/clear-windows-event-logs.md): https://attack.mitre.org/techniques/T1070/001/
- [Clear Command History](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/defense-evasion/indicator-removal/clear-command-history.md): https://attack.mitre.org/techniques/T1070/003/
- [File Deletion](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/defense-evasion/indicator-removal/file-deletion.md): https://attack.mitre.org/techniques/T1070/004/
- [Network Share Connection Removal](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/defense-evasion/indicator-removal/network-share-connection-removal.md): https://attack.mitre.org/techniques/T1070/005/
- [Timestomp](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/defense-evasion/indicator-removal/timestomp.md): https://attack.mitre.org/techniques/T1070/006/
- [Input Capture](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/input-capture.md): https://attack.mitre.org/techniques/T1056/
- [Keylogging](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/input-capture/keylogging.md): https://attack.mitre.org/techniques/T1562/004/
- [Lateral Movement](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/lateral-movement.md)
- [PowerShell Remoting](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/lateral-movement/lateral-movement.md)
- [Alternate Authentication Material](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/lateral-movement/alternate-authentication-material.md): https://attack.mitre.org/techniques/T1550/
- [Pass The Hash](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/lateral-movement/alternate-authentication-material/wip-pass-the-hash.md): https://attack.mitre.org/techniques/T1550/002/
- [Pass the Ticket](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/lateral-movement/alternate-authentication-material/wip-pass-the-ticket.md): https://attack.mitre.org/techniques/T1550/003/
- [Pass the Password](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/lateral-movement/alternate-authentication-material/pass-the-password.md)
- [File Execution Methods](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/file-execution-methods.md)
- [File Transfer Techniques](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/file-transfer-techniques.md)
- [Forced Coercion](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/forced-coercion.md)
- [URL File Attack](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/forced-coercion/url-file-attack.md)
- [LAPS](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/laps.md)
- [Network Sniffing](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/network-sniffing.md): https://attack.mitre.org/techniques/T1040/
- [Persistence](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/persistence.md)
- [AdminSDHolder](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/persistence/adminsdholder.md)
- [BITS Jobs](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/persistence/bits-jobs.md): https://attack.mitre.org/techniques/T1197/
- [Create Account](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/persistence/create-account.md): https://attack.mitre.org/techniques/T1136/
- [Local Account](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/persistence/create-account/local-account.md): https://attack.mitre.org/techniques/T1136/001/
- [Domain Account](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/persistence/create-account/domain-account.md): https://attack.mitre.org/techniques/T1136/002/
- [Cloud Account](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/persistence/create-account/cloud-account.md): https://attack.mitre.org/techniques/T1136/003/
- [Create or Modify System Process](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/persistence/create-or-modify-system-process.md): https://attack.mitre.org/techniques/T1543/003/
- [Windows Service](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/persistence/create-or-modify-system-process/windows-service.md): https://attack.mitre.org/techniques/T1543/003/
- [Custom SSP](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/persistence/custom-ssp.md)
- [DSRM](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/persistence/dsrm.md)
- [Persistence Notes](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/persistence/persistence.md)
- [Skeleton Key Attack](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/persistence/skeleton-key-attack.md)
- [Privilege Escalation](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/privilege-escalation.md)
- [Privilege Escalation Checklist](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/privilege-escalation/privilege-escalation-checklist.md)
- [DnsAdmin](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/privilege-escalation/dnsadmin.md)
- [Registry](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/privilege-escalation/registry.md)
- [Always Install Elevated](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/privilege-escalation/registry/registry-alwaysinstallelevated.md)
- [AutoRuns](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/privilege-escalation/registry/autoruns.md)
- [Service Exploits](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/privilege-escalation/service-exploits.md)
- [Insecure Service Permissions](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/privilege-escalation/service-exploits/insecure-service-permissions.md)
- [SCCM / MECM](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/sccm-mecm.md)
- [Recon](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/sccm-mecm/recon.md)
- [CRED-1 - PXE Abuse](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/sccm-mecm/cred-1-pxe-abuse.md)
- [CRED-2 - Policy Request Credentials](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/sccm-mecm/cred-2-policy-request-credentials.md)
- [CRED-3 - WMI Local Secrets](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/sccm-mecm/cred-3-wmi-local-secrets.md)
- [CRED-4 - CIM Repository](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/sccm-mecm/cred-4-cim-repository.md)
- [CRED-5 - MSSQL Database](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/sccm-mecm/cred-5-mssql-database.md)
- [ELEVATE-2 - Client Push](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/sccm-mecm/elevate-2-client-push.md)
- [TAKEOVER-2](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/sccm-mecm/takeover-2.md)
- [Timeroasting](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/timeroasting.md)
- [Tools](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/tools.md)
- [BloodHound](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/tools/bloodhound.md)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.