Active Directory DCSync Attack and Defense: Abusing Directory Replication Rights
How DCSync abuses AD replication rights via DRSUAPI to dump credentials, and how blue teams can detect and stop it.
credential-access
Active Directory 
Windows Privesc Practical Credential Theft with Mimikatz
A hands-on guide to dumping Windows credentials with Mimikatz and the LSA protections that stop it.
Windows Privesc Dumping LSASS Memory: Techniques and Detection Evasion
A practical guide to dumping LSASS memory with comsvcs.dll, procdump, and nanodump, plus parsing with pypykatz and blue-team defenses.
Windows Privesc Abusing SeBackupPrivilege and SeRestorePrivilege for Windows Privilege Escalation
How attackers abuse SeBackupPrivilege/SeRestorePrivilege to dump SAM, SYSTEM, and ntds.dit, plus blue-team detection and defense.
Linux Privesc SSH Key Hunting and Lateral Movement on Linux
Find SSH private keys, abuse authorized_keys and known_hosts, and pivot via agent forwarding across Linux hosts.
Linux Privesc Credential Hunting on Linux: From .bash_history to Config Files
A practical guide to hunting cleartext credentials on Linux hosts via history files, config files, and grep, plus defenses.
Tools & Defense Mastering the Impacket Suite: From Lateral Movement to Credential Extraction
A practical tour of Impacket's psexec, wmiexec, secretsdump, GetUserSPNs and smbserver, plus blue-team detection.