ADDS Persistance - Burn It, Burn It All

Overview: Active Directory Domain Services offer a wide range of lateral movement and privilege escalation techniques. Ethical offensive security professionals often appreciate AD-DS in this respect. But what about persistence? We will see together that when compromising an AD domain of a company, it's probably better to start from scratch. On the agenda: skeleton key, Golden gMSA, AdminSDHolder, DC Shadow, persistence via AD CS, etc. Limited budget for managing your AD? The attacker will do it for you (Note to CISOs and other corporate network managers, don't come to this talk, or at least not without Details: a good dose of antidepressants, we might ruin the mood)