Privilege Escalation

Linux Privilege Escalation: Attack Techniques and How to Detect Them

A complete guide to Linux privilege escalation — SUID abuse, sudo misconfig, cron hijacking, capabilities, and kernel exploits. Includes auditd rules, Sigma, Wazuh, and Sentinel KQL detections.

When Your Defender Becomes the Attacker: How Trusted Windows Processes Get Weaponized

Windows Defender and other high-privilege system processes are increasingly targeted by attackers. Learn how security tools become attack surfaces — and what you can do about it.

Active Directory Attacks: The Complete Attack Path Guide

A structured guide to Active Directory attack techniques — from BloodHound enumeration through Kerberoasting, LSASS dumping, ADCS abuse, and Shadow Credentials to Entra ID pivot. Every technique with detection coverage.

BloodHound from First Run to Domain Admin: A Practical Red Team Guide

A hands-on red team guide to BloodHound CE — from SharpHound data collection to reading attack paths and finding the fastest route to Domain Admin in Active Directory.

Shadow Credentials: Account Takeover Without a Password

Shadow Credentials abuse msDS-KeyCredentialLink via DACL misconfiguration to add a rogue certificate, authenticate via PKINIT, and extract NT hashes — no password required.

ADCS Abuse with Certipy: From Low-Priv User to Domain Admin via Certificate Services

Active Directory Certificate Services is installed in most enterprise networks — and almost always misconfigured. Here's how attackers exploit ESC1 through ESC8 with Certipy, and how to detect and stop them.