Active Directory:
Persistence
AD persistence via tickets, ACLs, shadow creds, and backdoor accounts
Account and ACL Persistence
Techniques for maintaining AD access via account manipulation, ACL abuse, and permission backdoors to ensure long-term persistence in compromised environments.
ADCS Certificate Persistence
Abuse AD Certificate Services to establish long-term persistence via certificate-based authentication, ESC techniques, and rogue template exploitation.
DSRM and Skeleton Key
Covers DSRM password abuse and Skeleton Key injection for persistent stealthy access to Active Directory domain controllers, bypassing standard authentication.
Golden and Silver Ticket Persistence
Forging Kerberos golden (krbtgt) and silver (service account) tickets for persistent AD access, bypassing standard authentication controls.
AD persistence techniques survive password resets, ticket expiration, and host reboots. Golden Tickets forged with the krbtgt hash grant domain-wide access until that hash is rotated twice. Silver Tickets target individual services without touching the DC.
Skeleton Key patches LSASS on a domain controller to accept a master password alongside real credentials. DSRM abuse and AdminSDHolder modification provide backup access paths that are rarely monitored. SID History injection lets a low-privilege account carry high-privilege SIDs without group membership changes visible in standard queries.