IV. Domain Persistence and Dominance
We validate this area during scoped assessments, documenting impact and remediation guidance.
Why it matters
- Abuse Kerberos functionality to persist with Domain Administrator privileges. Forge tickets to execute attacks like Golden Ticket and Silver Ticket for persistence. - Subvert domain-level authentication with Skeleton Key and custom Security Support Provider (SSP). - Abuse the DC safe mode Administrator for persistence. - Abuse protection mechanisms like AdminSDHolder for persistence. - Abuse minimal rights required for attacks like DCSync by modifying ACLs of domain objects. - Learn to modify the host security descriptors of the domain controller to persist and execute commands without needing Domain Administrator privileges.
How we test it
Our operators follow a structured checklist for this topic, adapted to your API surface and authentication model.
Testing approach
- Structured validation of IV. Domain Persistence and Dominance during scoped assessment.
- Evidence captured with reproducible steps for your engineering team.
What we look for
- Misconfigurations and control gaps related to IV. Domain Persistence and Dominance.
- Exploitable paths that could affect confidentiality, integrity, or availability.
Related topics
| Topic | Summary |
|---|---|
| Active Directory (AD) - Basics Understanding | Within Active Directory, there are three built-in groups that comprise the highest privilege groups in the director |
| Active Directory (AD) Terminology | We validate this area during scoped assessments, documenting impact and remediation guidance. |
| DLL | A DLL (Dynamic Link Library) is a file format used in Microsoft Windows environments to contain code, data, and resources that can be used by multiple programs simultaneously. DLLs help modularize applications, allowing them to share common functions without duplicating code acr… |
| Extended Active Directory (AD) Terminology | We validate this area during scoped assessments, documenting impact and remediation guidance. |
| I. Active Directory Enumeration | We validate this area during scoped assessments, documenting impact and remediation guidance. |
| II. Local Privilege Escalation | We validate this area during scoped assessments, documenting impact and remediation guidance. |