PetitPotam
A technique that forces a Windows server — ideally a domain controller — to authenticate to an address of the attacker's choosing. The opening move in nearly every relay chain since 2021.
Gilles Lionel published the method in July 2021. It abuses MS-EFSRPC, the encrypting file system's remote protocol, where calls such as EfsRpcOpenFileRaw take a path as an argument. Supply a UNC path pointing at your own machine and the server connects there and authenticates with its machine account, entirely unprompted. In the original version no credentials were required at all. The combination that made it notorious is relaying the domain controller's authentication onward to the certificate service's web enrolment, obtaining a certificate for the domain controller and thereby owning the domain. Microsoft closed parts of it, but the coercion family has since grown to include DFSCoerce and ShadowCoerce.