If a hacker able to get local admin rights and then from there local domain admin's NTLM hash.
Can he use this hash without cracking, to access shared folders in the network and the default C drive share on all network machines ?
I know he himself using local account he compromised can become domain admin by several ways. But would that be detectable ?
What would be the most passive way to move forward for him ?