Hashdump without the DC using DCSync (because we all wanted it)

Introduces Invoke-MassMimikatz-PsRemoting, which combines SPN discovery, PowerShell Remoting, and Invoke-Mimikatz to harvest credentials from many domain systems automatically.

Replicates ntds.dit dumping with pure WMI Win32_ShadowCopy calls instead of vssadmin, remotely snapshotting a domain controller to pull password hashes while trimming the tool-based IoC footprint.

Introduces PowerUpSQL discovery functions that enumerate SQL Server instances from local, network, and domain perspectives, an essential first step for data hunting or privilege escalation.

With only the Public role, native SQL Server functions can enumerate AD users, groups, and computers; NetSPI ships PowerShell and Metasploit modules automating this via direct connections or SQLi.

Any domain user can query AD SPN records to enumerate every SQL Server—instances and ports included—without noisy scans; NetSPI's Get-SQLServerAccess module then tests each for accessible logins.

Shows how to find systems where Domain Admins are likely logged in by querying the ServicePrincipalName attribute over LDAP, with a PowerShell module to automate the process.