Multi-Forest Active Directory Attacks
20%
Cross-forest trust abuse, SID history, PAM trust, foreign group membership exploitation
Advanced Kerberos & Delegation
15%
RBCD abuse, Shadow Credentials, KrbRelayUp, cross-realm ticket forging
AD Certificate Services (ADCS)
15%
ESC1-ESC8 exploitation, CA compromise, certificate-based persistence
Azure AD & Hybrid Identity
15%
Azure AD Connect abuse, ADFS Golden SAML, hybrid identity attack paths
Advanced MSSQL Attacks
10%
MSSQL service account abuse, CLR assembly upload, chained linked server RCE
Advanced Persistence
15%
DCShadow, Skeleton Key, directory service restore mode, GPO abuse, AdminSDHolder
Detection Evasion & Hunting Awareness
10%
Living-off-the-land, log evasion, OPSEC-safe techniques, blueteam artifact avoidance