Windows Steal Authentication Certificates - ESC1 Abuse
Steal or Forge Authentication Certificates
Steal or Forge Authentication Certificates
Msiexec, System Binary Proxy Execution
NTDS, OS Credential Dumping
Match Legitimate Name or Location, Masquerading, OS Credential Dumping, Active Scanning
File and Directory Permissions Modification, Windows File and Directory Permissions Modification