Blood Hound - https://github.com/adaptivethreat/BloodHound

• Automate with Blood Hound - https://byt3bl33d3r.github.io/automating-the-empire-with-the-death-star-getting-domain-admin-with-a-push-of-a-button.html
• Automate Blood Hound - https://github.com/mdsecactivebreach/ANGRYPUPPY
• Extending Blood Hound - https://speakerdeck.com/porterhau5/extending-bloodhound-for-red-teamers

CrackMapExec - https://github.com/byt3bl33d3r/CrackMapExec

• Intro - https://byt3bl33d3r.github.io/getting-the-goods-with-crackmapexec-part-1.html

EmPyre - http://www.rvrsh3ll.net/blog/empyre/empyre-engaging-active-directory/

Red Teaming AD Red Teaming AD (PDF)

• https://adsecurity.org/wp-content/uploads/2016/08/DEFCON24-2016-Metcalf-BeyondTheMCSE-RedTeamingActiveDirectory.pdf

Attack Methods to Domain Admin - https://adsecurity.org/?p=2362

Attack Domain Trusts - https://posts.specterops.io/a-guide-to-attacking-domain-trusts-971e52cb2944