Windows Token Privileges: A Field Checklist
Lab whoami /priv dump, OpenProcess notes on a process we own, integrity vs enabled privileges — no token-steal PoC.
Windows
Kerberos Ticket Times and Checksums for Forensics
Lab klist dump, field-by-field decode of times and checksum types, clock-skew 401 — no ticket-forging steps.
Print Spooler LPE Class Lessons for Operators
Lab spooler service ACL and RPC interface dump, Point-and-Print registry, 7036/808 logs — no spool exploit.
NTLM Relay Defense Notes: Signing, EPA, and SMB/LDAP Controls
Lab registry/GPO signing dumps, Wireshark NTLM field names, failed-auth 4625 — no relay tool command line that fires.
sAMAccountName Impersonation Class (CVE-2021-42278 / CVE-2021-42287)
Lab event 4742/4768 samples redacted, computer-account naming checks, patch verification — no noPac exploit.
Windows Delegation Edge Cases: Constrained, Unconstrained, and RBCD
Lab klist/setspn dumps redacted, unconstrained vs constrained vs RBCD text diagrams — flags and ACLs, not an abuse chain.
Active Directory Recon Notes: What Enumerations Reveal
Fake lab DC ldapsearch and PowerView-style listings, 4662/1644/4624 event IDs — inventory, not an attack playbook.
Kerberos Constrained Delegation Map for Analysts
Lab klist and setspn dumps redacted, constrained-delegation allow-list map — no ticket forging, no S4U abuse.