Methodology¶ Poison & Relay¶ Run Responder Run ntlmrelayx Check for RPC Coercion Discovery and Audit¶ AS-REP Roast SMB/RPC Enumeration User Enumeration Password Spraying Bloodhound LDAP Checks SMB Data Hunting cpassword Privilege Escalation¶ Kerberoast BadSuccessor AD CS Abuse