https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/top-five-ways-spiderlabs-got-domain-admin-on-your-internal-network/ https://adam-toscher.medium.com/top-five-ways-i-got-domain-admin-on-your-internal-network-before-lunch-2018-edition-82259ab73aaa https://offs3cg33k.medium.com/active-directory-attack-phase-ad-fu-6ed5e5ce1985 User-Pass Enum LLMNR - Step 1 SMB Relay - Step 2 IPv6 - Step 3 https://zer1t0.gitlab.io/posts/attacking_ad/ https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet