ad-arsenal

Use when selecting command patterns for authorized AD testing or when documenting OPSEC and defender-visible telemetry—NetExec/CrackMapExec, Impacket, Certipy, SharpHound, representative Windows Event IDs, and certificate enrollment logs. Use to enrich report appendices and kickoff expectations, not for EDR evasion guidance.