| Attack and defend active directory using modern post exploitation adversary tradecraft activity |
https://github.com/infosecn1nja/AD-Attack-Defense |
| Offensive DPAPI Abuse |
https://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse |
| Internal-Monologue - Retrieving NTLM Hashes without Touching LSASS |
https://github.com/eladshamir/Internal-Monologue |
| Constrained delegation information |
https://labs.mwrinfosecurity.com/blog/trust-years-to-earn-seconds-to-break/ |
| Constrained delegation information |
http://www.harmj0y.net/blog/activedirectory/s4u2pwnage/ |
| Golden Ticket detections |
https://adsecurity.org/?p=1515](https://adsecurity.org/?p=1515) |
| Golden Ticket detections |
https://docs.microsoft.com/en-us/azure-advanced-threat-protection/suspicious-activity-guide#kerberos-golden-ticketa-namegolden-ticketa |
| A Guide to Attacking Domain Trusts |
http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts |