Impacket psexec (post-DA)

psexec.py <domain>/administrator@<target> -hashes :<nthash>

Executes remote commands on domain hosts as Administrator using NTLM hashes (pass-the-hash).

After obtaining the Domain Administrator hash (via DCSync or Golden Ticket), use psexec.py to move laterally and execute commands on any domain host. This is the final step to take control of the entire infrastructure.

If the target host has mandatory SMB signing or the EDR monitors psexec usage. In environments with EDR, prefer techniques like WMI or Schtasks.