ADCS ESC1
A misconfigured certificate template that lets any user request a certificate issued in the domain administrator's name. Domain takeover in about a minute.
Four properties in a template have to coincide: it lets the requester supply the subject alternative name, it carries an extended key usage good enough for client authentication, it is open for enrolment by low-privileged groups, and it requires no manager approval. With all four true, an ordinary user can request a certificate stating that its holder is somebody else, then log in as that person via PKINIT. The certificate is also valid for years and is unaffected by password changes, which makes it a durable foothold. The path was catalogued in SpecterOps' 2021 Certified Pre-Owned paper, which numbered it ESC1 of a dozen or so.