AD-COERCE-DFSCOERCEInitial Access

DFSCoerce (MS-DFSNM)

NetrDfsRemoveStdRoot forces the target to authenticate; survives EFSRPC patches.

§ Where this technique fits

AD-COERCE-DFSCOERCE is catalogued under the Initial Access tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 3 on average.

§ Dossiers chaining this technique

ADCS ESC11 → certificate via RPC (no web enrollment)
When the CA's ICertPassage RPC interface allows NTLM without signing, relay any coerced auth directly to RPC and obtain a cert — bypasses HTTP-only mitigations.
step 3 / 6

§ What commonly comes next

01
Pass the Ticket
T1550.003 · Lateral Movement
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

ADCS ESC11 → certificate via RPC (no web enrollment)

§ What commonly comes next