Books

• Windows Internals, Sixth Edition, Part 2
• How to Hack Like a PORNSTAR: A step by step process for breaking into a BANK
• Windows® via C/C++ (Developer Reference) (English Edition)
• The Hacker Playbook 3: Practical Guide To Penetration Testing
• Windows Internals, Sixth Edition, Part 1
• Windows Internals, Seventh Edition, Part 1

Courses

• Penetration Testing with Kali (PWK) Online Security Training Course
• Offensive Security Certified Expert
• Advanced Windows Exploitation: Live Hands-on Penetration Testing Training
• Windows API Exploitation Recipes: Processes, Tokens and Memory RW
• Powershell for Pentesters - Pentester Academy
• WMI Attacks and Defense - Pentester Academy
• Windows Red Team Lab - Pentester Academy

Defense Evasion

AMSI

• Windows Defender ATP machine learning and AMSI: Unearthing script-based attacks that ‘live off the land’

AppLocker & Application Whitelisting

• How to Evade Application Whitelisting Using REGSVR32
• UltimateAppLockerByPassList
• What Is AppLocker?

AV

• DerbyCon3 - Antivirus Evasion Lessons Learned
• DerbyCon7 - T110 Modern Evasion Techniques
• DerbyCon7 - Evading Autoruns
• Red Team Techniques for Evading, Bypassing & Disabling MS
• How to Bypass Anti-Virus to Run Mimikatz
• AV Evasion - Obfuscating Mimikatz
• Getting PowerShell Empire Past Windows Defender

LAPS

• Local Administrator Password Solution
• Malicious use of Microsoft LAPS

Exfiltration

AppLocker & Application Whitelisting

• Abusing Windows Management Instrumentation (WMI)
• DEF CON 23 - Panel - WhyMI so Sexy: WMI Attacks - Real Time Defense and Advanced Forensics
• DerbyCon3 - Living Off The Land A Minimalist's Guide To Windows Post Exploitation

Lateral Movement

LLMNR/NBT-NS poisoning

• An SMB Relay Race – How To Exploit LLMNR and SMB Message Signing for Fun and Profit

Pass the Hash

• BH2013 - Pass the Hash 2: The Admin's Revenge
• Pass-the-Hash Is Dead: Long Live LocalAccountTokenFilterPolicy
• BH2013 - Pass the Hash and other credential theft and reuse: Preventing Lateral Movement...
• From Pass-the-Hash to Pass-the-Ticket with No Pain

Phishing

DDE

• Abusing Microsoft Office DDE
• Office-DDE-Payloads
• Microsoft Office Dynamic Data Exchange(DDE) attacks

HTA

• Hacking around HTA files

Macros

• Phishing with Macros and Powershell

Maldocs

• Phishing with Maldocs
• Phishing with Empire

PowerShell

AppLocker & Application Whitelisting

• DEF CON 18 - David Kennedy "ReL1K" & Josh Kelley - Powershell...omfg
• DEF CON 22 - Investigating PowerShell Attacks
• DerbyCon2016 - 106 PowerShell Secrets and Tactics Ben0xA
• Daniel Bohannon – Invoke-Obfuscation: PowerShell obFUsk8tion
• BH2017 - Revoke-Obfuscation: PowerShell Obfuscation Detection (And Evasion) Using Science

Privilege Escalation

LLMNR/NBT-NS poisoning

• Level Up! Practical Windows Privilege Escalation - Andrew Smith
• Windows Privilege Escalation Presentation
• DEF CON 22 - Kallenberg and Kovah - Extreme Privilege Escalation On Windows 8/UEFI Systems
• DEF CON 25 - Morten Schenk - Taking Windows 10 Kernel Exploitation to the next level
• Windows Kernel Exploits
• DerbyCon7 - Not a Security Boundary Bypassing User Account Control

Token Impersonation

• Rotten Potato

System Architecture

Active Directory

• ADsecurity.org
• DEFCON 20: Owned in 60 Seconds: From Network Guest to Windows Domain Admin
• BH2015 - Red Vs. Blue: Modern Active Directory Attacks, Detection, And Protection
• BH2016 - Beyond the Mcse: Active Directory for the Security Professional
• BH2017 - Evading Microsoft ATA for Active Directory Domination
• DEFCON 26 - Exploiting Active Directory Administrator Insecurities
• BH2017 - An ACE Up the Sleeve: Designing Active Directory DACL Backdoors
• DerbyCon7 - Building the DeathStar getting Domain Admin with a push of a button (aka how I almost automated myself out pf a job)
• DerbyCon4 - How to Secure and Sys Admin Windows like a Boss
• DerbyCon4 - Abusing Active Directory in Post Exploitation

Kerberos

• Basic attacks on communication protocols – replay and reflection attacks
• MicroNugget: How Does Kerberos Work?
• MIT 6.858 Fall 2014 Lecture 13: Kerberos
• BH2014 - Abusing Microsoft Kerberos: Sorry You Guys Don't Get It
• How Attackers Use Kerberos Silver Tickets to Exploit Systems
• DerbyCon4 - Et tu Kerberos
• DerbyCon7 - Return From The Underworld The Future Of Red Team Kerberos
• DerbyCon4 - Attacking Microsoft Kerberos Kicking the Guard Dog of Hades
• Protecting Privileged Domain Accounts: Network Authentication In-Depth
• Kerberos in the Crosshairs: Golden Tickets, Silver Tickets, MITM, and More
• Kerberos (I): How does Kerberos work? – Theory

Lsass SAM NTLM GPO

• Retrieving NTLM Hashes without touching LSASS: the “Internal Monologue” Attack
• BH2002 - Cracking NTLMv2 Authentication
• Abusing GPO Permissions
• Targeted Kerberoasting
• DerbyCon7 - Securing Windows with Group Policy

WinAPI

• DerbyCon4 - Getting Windows to Play with Itself: A Pen Testers Guide to Windows API Abuse

Tools

Adversary Emulation

• Cobalt Strike
• Awesome Pentest
• Red Team Automation - RTA
• CALDERA
• Atomic Red Team
• Metta
• Awesome Red Teaming
• Red Teaming Toolkit
• Red Team Infrastructure Wiki
• Darkmoon

HTA

• PSExec
• Mimikatz
• BloodHound
• Empire
• Nishang
• Responder
• CrackMapExec