Account Hunting for Invoke-TokenManipulation

**Executive summary:** This article demonstrates a scalable offensive technique for harvesting domain admin Kerberos tokens and credentials by delivering in-memory PowerSploit/Mimikatz payloads via encoded PowerShell, executing them remotely with Metasploit psexec_command, and exfiltrating results to an SMB share; example commands, outputs, and helper scripts are provided to automate collection across many hosts.