Shadow Credentials Attack

The post explains the Shadow Credentials attack, which exploits Active Directory Certificate Services (AD CS) to inject custom certificates into a user account, allowing attackers persistent access by modifying the msDS-KeyCredentialLink attribute. It provides details on lab setup, various exploitation methods, and mitigation techniques. Additionally, the post covers Kerberos authentication and its PKINIT extension, and lists tools for both exploitation and post-exploitation. Finally, it describes methods for effectively detecting and mitigating these attacks.