A penetration tester would like to collect permission details for objects within the domain.

To collect permission details for objects within an Active Directory domain, the PenTest+ workflow most closely aligns with using SharpHound (the BloodHound data collector) followed by BloodHound analysis. SharpHound is executed from a domain-joined or internally reachable system using a valid AD account to enumerate domain relationships, including group membership, sessions, local admin rights, and—most importantly for this question—object control and ACL-based permissions (for example, rights that allow modifying users, resetting passwords, adding group members, or controlling GPOs). BloodHound then imports this collected graph data and allows the tester to run Cypher queries to identify effective privileges, abuse paths, and misconfigurations that enable privilege escalation or lateral movement.

Rubeus is primarily focused on Kerberos ticket operations (TGT/TGS manipulation, roasting, delegation abuse) and is not a Cypher-query permission-mapping platform. CrackMapExec supports network/AD operations, but it is not the standard toolchain for graph-based permission path analysis described in PenTest+. Registry collection is unrelated to enumerating domain object permissions.