Abuse ACL access over groups
Use access rights over a group to add users
Use access rights over a group to add users
Use access rights over a user to take over that user account.
Abuse of ACL access rights to achieve lateral movement
Read the NT password hash of Group Managed Service Accounts (gMSA)