AD-ACL-PERSISTPersistence

DACL Backdoor on Domain Object

Add stealth ACEs (GenericAll, WriteDACL, GetChanges) on a high-value object for re-entry.

§ Where this technique fits

AD-ACL-PERSIST is catalogued under the Persistence tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 7 on average.

§ Dossiers chaining this technique

Post-Domain Admin persistence: Golden Ticket + DCShadow + AdminSDHolder
Once Domain Admin is achieved, plant layered persistence so a krbtgt rotation, password resets, and ACL clean-up do not all evict the attacker.
step 7 / 7

§ Where this technique fits

§ Dossiers chaining this technique

Post-Domain Admin persistence: Golden Ticket + DCShadow + AdminSDHolder