Ok, I know we say this every time, but it is true this time yet again: this is our favorite tale of pentest pwnage. It involves a path to DA we’ve never tried before, and introduced us to a new trick that one of our favorite old tools can do:

rubeus.exe monitor /interval:5 /nowrap /runfor:60 /registry:SOFTWARE\MONITOR