Persistence on MrAzoth

Persistence — From Kali

Mon, 01 Jan 0001 00:00:00 +0000

Quick Reference

Technique	Requirement	Detection Risk
DCSync	Domain Admin or explicit replication rights	High — replication request from non-DC
Golden Ticket	krbtgt NTLM + AES256 hash, domain SID	Medium — no TGT event (4768) on DC
Silver Ticket	Service account NTLM hash, domain SID, SPN	Low — no DC contact at all
Diamond Ticket	krbtgt AES256, valid user credentials	Low — based on a real TGT
NTDS.dit VSS	Shell on DC, local admin	High — shadow copy creation event
DPAPI Backup Key	Domain Admin, DC access	Medium — LDAP/RPC request to DC
ACL-based (DCSync rights)	WriteDACL or GenericAll on domain root	Low — ACL change may not alert
Machine Account creation	Any user with MachineAccountQuota > 0	Low
Pass-the-Hash persistence	Local admin hash, no domain rights needed	Low — appears as normal auth

DCSync

What It Is

DCSync abuses the Directory Replication Service (DRS) protocol. Domain controllers use DRS to replicate directory data between themselves. The GetNCChanges function is the core RPC call used. Any account with the following rights on the domain root object can invoke this:

Persistence — From Windows

Mon, 01 Jan 0001 00:00:00 +0000

Domain persistence techniques after AD compromise: Golden/Silver/Diamond Tickets, DCSync backdoors, AdminSDHolder, ACL abuse, WMI subscriptions, and DPAPI backup keys.

GPO Abuse — From Windows

Mon, 01 Jan 0001 00:00:00 +0000

Quick Reference

Technique	Tool	Requirement	Effect
Immediate Scheduled Task	SharpGPOAbuse	Write on GPO	Code exec as SYSTEM on all linked machines
Restricted Groups	SharpGPOAbuse	Write on GPO	Add attacker to local Admins
User Rights Assignment	SharpGPOAbuse	Write on GPO	Grant SeDebugPrivilege / SeImpersonatePrivilege
Manual XML task	PowerShell / SYSVOL write	Write on GPO or SYSVOL	Arbitrary command as SYSTEM
New GPO + Link	PowerView / RSAT	CreateGPO right + link permission	Full control over target OU
GPO Delegation read	PowerView / BloodHound	Any domain user	Map attack surface

GPO Fundamentals

Group Policy Objects (GPOs) are containers of policy settings applied to users and computers. They are linked to Organizational Units (OUs), Sites, or the Domain. When a machine or user logs in, the domain controller delivers applicable GPOs via SYSVOL (a shared folder replicated to all DCs). The machine then applies them every 90 minutes by default (± 30-minute random offset), or immediately on gpupdate /force.