Let me introduce you to: https://reddthat.com/c/dog_doesnt_eat !dog_doesnt_eat@reddthat.com

Those pride flags look awesome 👍 love the color selections!

There are literally hundreds to thousands. Many of them are horded by governments, APTs, and pen testers. I personally abused a 10 year old CVE for pen tests that was known to be used by non US government entities for a zero click code execution on opening a word doc.

Then there are things that are vulnerabilities but cannot be fixed as they are intensic to how Windows functions. Some can be hardened from the defaults but break compatibility and some cannot be fixed without a complete rewrite of how Windows and AD work. Disa stigs will give you defaults that can be hardened. Requirements for all domain users to see all GPOs, users, groups in order for AD to work is an example of something that cannot be fixed without a complete rewrite. That means an in privileged user can get a list of all users, all domain administrator, names of all computers on the domain, etc. As an attacker, that is invaluable.

Short answer, that list is to big and changes constantly. None that would be comprehensive, but disa stigs is a good place to start.

As an offensive security worker… I can’t help but read people listing out their attack surface 😂