Methodology¶ Poison & Relay¶ Run Responder Run ntlmrelayx Check for RPC Coercion Discovery and Audit¶ SMB/RPC Enumeration User Enumeration Password Spraying Bloodhound LDAP Checks SMB Data Hunting cpassword Privilege Escalation¶ BadSuccessor AD CS Abuse