Extract Kerberos tickets and keys from LSA with Rubeus
Dumping tickets from LSA gives you TGTs to pass, and requesting them for kerberoastable SPNs yields hashes to crack offline.
Tag: lateral-movement
Move as another logged-on user by stealing their token
On a multi-user host, duplicating the primary token of another session lets you act as that user, including a domain admin who logged in.
Pivot with AWS SSM instead of SSH
With ssm:StartSession or SendCommand you get shells on instances without keys, ports, or touching the network.
Abuse a mounted Kubernetes service account token
A shell in a pod usually has a service account token; check what it can do against the API before anything else.
Relay NTLM to LDAP to configure RBCD
When SMB signing is off and LDAP signing is not enforced, coerced auth relayed to LDAP writes delegation for you.
Abuse writable GPOs for code execution on an OU
Write access to a GPO linked to an OU means an immediate or scheduled task on every computer in that OU.
Resource-based constrained delegation from a single GenericWrite
One writable computer object plus a controlled account lets you S4U your way to any user on that host.