The ANT1-R4BB1T-H0L3 CH3CKL15T

After recently taking another certification exam, I thought it would be useful to put together a comprehensive list of things that are often forgotten or overlooked under exam pressure, or even during casual CTFs and lab practice.

I created this checklist to help combat that feeling of frustration when it seems like you've tried everything, only to realize the answer was sitting right in front of you the entire time. Hopefully, this serves as a useful reference for you to add to or to help catch things you might have accidentally overlooked.

~ Mal3vant

1. Current Access & Objectives

• What rights do I currently have? (User, Local Admin, SYSTEM, root)
• Where am I trying to go next? (Another user, host, or subnet)
• What is the next objective (pivot, enumerate, privesc, etc.), and what evidence do I need?

2. Privilege Escalation

• Did I run WinPEAS, LinPEAS, or other relevant privesc tool?
• Did I miss an opportunity to escalate privileges on a previously compromised host?

3. Credentials & Hashes

• Have I attempted to crack all hashes?
• Have I tested pass-the-hash on all users?
• Have I checked for password reuse?
• Have I checked accessible files, scripts, configurations, backups, and histories for credentials, as well as unconventional locations such as the Recycle Bin?

4. Credential Access & Sessions

• Can I run Mimikatz or an appropriate alternative on the current machine? (Not a remote dump even if it was Impacket secrets.)
• Are there other logged-in users, privileged sessions, or accessible processes worth investigating?
• Did a Domain Admin log in? What apps did they use? What did they do?
• Did I miss an opportunity to mine credentials on a previously compromised host (Mimikatz)?

5. Other Hosts & Lateral Movement

• Which hosts have I compromised, and what access do I have on each?
• Do the target machines have local accounts?
• Have I checked accessible shares, remote services, and administrative interfaces?
• Are there file paths, scripts, configurations, or documents referencing other machines?

6. User Profiles & File System

• Have I checked Desktop, Documents, Downloads, and other relevant directories on each machine?
• Have I FULLY investigated unusual directories or unknown programs?
• Don't assume what an unknown application does without investigating a little.
• Have I FULLY searched through interesting files and folders using grep, findstr, or equivalent tools for mentions of creds?
• Don't assume what's a file is without investigating a little.

7. Domain & Network Context

• What privileges do all owned domain users currently have?
• Have I checked interesting group memberships and delegated permissions for all domain users?
• If pivoting is required, does my current host have a NIC or route into the target network?
• Check certificate attacks.

Thanks for reading!