Today is my favorite pentest pwnage tale of 2026 – and maybe ever!  It centers around an ADCS abuse via an attack path I’d never seen before.  Tips include:

• Use Netexec to pull Powershell history
• Trying to steal reg hives and the EDR is made?  Try copying them out to \\some-other-server.domain.com\share
• This post featured interesting use of the Responder -N option