srl
Initial Access (Active Directory)
After gaining access to the network segment where the AD environment resides — often through pivoting from a previously compromised host — the goal is to find the Domain Controller, enumerate the domain without credentials if possible, and convert unauthenticated reconnaissance into a valid credential or session. The techniques below are ordered roughly by noise level and prerequisite: unauthenticated enumeration first, then poisoning and relay, then credential-based spraying, then modern coercion/relay chains that bypass SMB signing entirely.