Active Directory

Core pivots

Area	Inspect
Account	Age, status, groups, delegation, SPNs, pre-auth settings
Authentication	Kerberos/NTLM, source host, logon type, failures/successes
Privilege	Group changes, replication rights, admin sessions
Directory discovery	LDAP scope, volume, queried objects, requester
Lateral movement	RDP, SMB, service creation, admin shares

Known identity → source host → authentication → target service → resulting action

Pivot next: endpoint process telemetry on requester/target, DC events, network flow, ticket details, and privilege changes.