Obtaining and Detecting Domain Persistence
Grant Bugher surveys stealthy Active Directory persistence techniques—including Golden Tickets and adminSDHolder—and provides effective detection telemetry.
Summary
Architecture and Background
When a Windows domain is compromised, an attacker has several options to create backdoors, obscure his tracks, and make his access difficult to detect and remove. In this talk, I discuss ways that an attacker who has obtained domain administrator privileges can extend, persist, and maintain control, as well as how a forensic examiner or incident responder could detect these activities and root out an attacker.
Vulnerability Analysis
Grant Bugher has been hacking and coding since the early 90's and working professionally in information security for the last 11 years. He is currently a security consultant and engineer for a cloud service provider, and has previously been an architect, program manager and software engineer on a variety of online services, developer tools and platforms.
Exploitation and Demonstrations
Grant is a prior speaker at BlackHat and DEF CON and a regular DEF CON attendee since DEF CON 16. Most of his research and work is on cloud computing and storage platforms, application security, and detecting attacks against web-scale applications.
Remediation and Defensive Strategies
Related talks
Blue Team Village·37 min
Siyu Zhu
Due to internal environment of Windows domains is always too tolerant, and enterprises are more concerned about border defenses than internal security, the penetration behavior based on Windows Active Directory has be...
Main Stage·50 min
Sean Metcalf
Sean Metcalf breaks down modern Active Directory exploitation vectors—including Golden Tickets, Skeleton Key, and DCShadow—alongside essential enterprise hardening practices.
Main Stage·34 min
Yuval Gordon
Discloses critical design flaws in delegated Managed Service Accounts (dMSAs) in Windows Server 2025, enabling unprivileged domain users to become Domain Admins.