Dumping Active Directory Domain Info – in Go!

Thomas Elling demonstrates querying Active Directory through SQL Server's OLE DB ADSI provider with OPENQUERY and OPENROWSET, adding new PowerUpSQL functions that automate AD recon from SQL servers.

Introduces Invoke-MassMimikatz-PsRemoting, which combines SPN discovery, PowerShell Remoting, and Invoke-Mimikatz to harvest credentials from many domain systems automatically.

SpecterOps argues identity risk now extends beyond Tier Zero, as attackers increasingly use legitimate credentials and trusted relationships to reach backups, regulated data, and other critical workloads.

NetblockTool is a Python tool that automates netblock discovery, scraping Google dorks, ARIN, and IPinfo to build a confidence-ranked list of IP ranges owned by a company and its subsidiaries.

Analyzes leftover domain-validation TXT records across a million domains to fingerprint the online service providers a company uses, releasing a PowerShell script to automate the reconnaissance.

Kevin Robertson details ten attacker rules for MachineAccountQuota, which lets unprivileged users add up to 10 machine accounts, plus Powermad techniques and the defense of setting MAQ to 0.