feat: add ntlm hash support for laps extraction and gmsa exploit detection#277

Merged

l50 merged 10 commits into

feat/more-attack-covfrom

feat/dreadgoad-tier1-fixes

May 12, 2026

Commits on May 12, 2026

refactor: update acl discovery logic to include dominated domains
l50
committed
feat: add ntlm hash support for domain-wide laps sweep and laps_dump
l50
committed
feat: differentiate intra-forest and inter-forest trust escalation handling
l50
committed
feat: add gMSA principal detection and exploit token emission for secretsdump hashes
l50
committed
fix: skip self-coerce on unconstrained delegation when host is also domain controller
l50
committed
fix: remove unnecessary into_iter calls when chaining vectors
l50
committed
test: add and refactor helper functions with comprehensive unit tests
l50
committed
refactor: extract and unit test trust and LAPS work item builders
l50
committed
ci: add feat/more-attack-cov branch to PR triggers in workflows
l50
committed
Merge remote-tracking branch 'origin/feat/more-attack-cov' into feat/dreadgoad-tier1-fixes
l50
committed