Whitepaper called From Zero Credentials to Full Domain
Compromise. This paper covers techniques penetration testers can
use in order to accomplish an initial foothold on target networks
and achieve full domain compromise without executing third party
applications or reusing clear text credentials.
Read more https://packetstormsecurity.com/files/157082/from_zero_to_compromise.pdf