Active Directory:

Persistence

AD persistence via tickets, ACLs, shadow creds, and backdoor accounts

4 guides • Created Apr 5, 2026 • Updated Apr 30, 2026

4 guides

Account and ACL Persistence

Techniques for maintaining AD access via account manipulation, ACL abuse, and permission backdoors to ensure long-term persistence in compromised environments.

Apr 5, 2026 • 4 min read

ADCS Certificate Persistence

Abuse AD Certificate Services to establish long-term persistence via certificate-based authentication, ESC techniques, and rogue template exploitation.

Jun 11, 2026 • 5 min read

DSRM and Skeleton Key

Covers DSRM password abuse and Skeleton Key injection for persistent stealthy access to Active Directory domain controllers, bypassing standard authentication.

Jun 11, 2026 • 4 min read

Golden and Silver Ticket Persistence

Forging Kerberos golden (krbtgt) and silver (service account) tickets for persistent AD access, bypassing standard authentication controls.

Apr 5, 2026 • 4 min read

AD persistence techniques survive password resets, ticket expiration, and host reboots. Golden Tickets forged with the krbtgt hash grant domain-wide access until that hash is rotated twice. Silver Tickets target individual services without touching the DC.

Skeleton Key patches LSASS on a domain controller to accept a master password alongside real credentials. DSRM abuse and AdminSDHolder modification provide backup access paths that are rarely monitored. SID History injection lets a low-privilege account carry high-privilege SIDs without group membership changes visible in standard queries.