Persistence on Domain Level

During an offensive operation, adversaries need to maintain their access to the target environment. Various activities such as reboots and changing users’ passwords can disrupt the operation’s flow. To overcome interruptions, there are techniques that allow us to achieve persistence. In this chapter, we will not cover host persistence techniques on Windows workstations and servers. Instead, we will focus our attention on domain-level persistence and techniques specific to domain controllers only. Our first topic is the most famous jewelry tickets (golden, silver, diamond, and sapphire). We will discuss the differences between them and demonstrate their practical usage with OpSec considerations. Other domain-level persistence topics, such as adding to a SID History attribute and an AdminSDHolder domain object ACL and DACL manipulation, and delegation privilege abuse, will be explained and illustrated with practical examples. We will close the...