AD-SKELDefense Evasion

Skeleton Key

Patch LSASS on a DC so every account accepts a master password alongside its real one.

§ Where this technique fits

AD-SKEL is catalogued under the Defense Evasion tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 6 on average.

§ Dossiers chaining this technique

Post-Domain Admin persistence: Golden Ticket + DCShadow + AdminSDHolder
Once Domain Admin is achieved, plant layered persistence so a krbtgt rotation, password resets, and ACL clean-up do not all evict the attacker.
step 6 / 7

§ What commonly comes next

01
DACL Backdoor on Domain Object
AD-ACL-PERSIST · Persistence
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

Post-Domain Admin persistence: Golden Ticket + DCShadow + AdminSDHolder

§ What commonly comes next