Reconnaissance Start
Initial Attack Vectors
Post-Compromise
Enumeration
Enabled but not required Enabled and required
Post-Compromise
Attacks MITM6 PoC SMB Signing
Domain
Compromised
Success
Placeholder/Stage
IPv6 Attack SMB Relay LLMNR Poisoning
Success Fail
Crack
Password
LDAP Domain Dump
Bloodhound
Reverse Shell Plumhound
PingCastle
Yes Admin Access No
(See Preconditions in
notes)
Gather Information for
Mimikatz Token Impersonation
Lateral Movement
Pass the Hash
Pass the Password
Privilege Escalation
Domain Admin Created
DA credentials acquired
File Uploads Credential Dumping Kerberos Dangerous Old
ZeroLogon
Dumping the GPP/cPassword
LNK File Attack Kerberoasting PrintNightmare
NTDS.dit Attacks
Sam the Admin
Golden/Silver Ticket
Attack
Pass-the-Ticket