Windows Domain Admin Impersonation Indicator
Steal or Forge Kerberos Tickets
Steal or Forge Kerberos Tickets
Modify Registry, OS Credential Dumping
Permission Groups Discovery, Domain Groups
Cloud Accounts, Valid Accounts
Unsecured Credentials, Group Policy Preferences