Walking an x64 call stack using UNWIND data structures.
Offensive PowerShell
Using GetDelegateForFunctionPointer to execute Win32 API’s from memory in Powershell.
Active Directory Schema Modification
Changing default security descriptor properties to escalate from a child to parent domain.