Persistence and Defense Evasion in AD
What this domain tests
Persistence and Defense Evasion in AD tests maintaining access without losing the domain or tripping defenses. It covers domain-level backdoors, host-level persistence, and the logging that exposes both.
Core rules and concepts
- Domain persistence: Golden Ticket, DCSync backdoor, AdminSDHolder ACL, SID history, and certificate template backdoors.
- Host persistence: scheduled tasks, services, WMI event subscriptions, and startup scripts.
- Defense evasion starts with understanding logs: 4624 logons, 4769 Kerberos service tickets, 4662 directory access, and 5136 object changes.
- Use native tools where possible, avoid known-bad binaries, and document every change so it can be removed.
Worked example
To persist, add an ACE to AdminSDHolder granting GenericAll to a controlled user. SDProp propagates the ACE to protected groups on its next cycle. Verify with Get-DomainObjectAcl -Identity AdminSDHolder. Reasoning: this survives password resets and is reversible if documented. A Golden Ticket is faster but noisier and breaks when krbtgt is rotated twice.
Traps that cost marks
- Over-persistence that changes the environment before the report is written.
- Leaving Mimikatz binaries or service executables on disk.
- Adding AdminSDHolder ACEs without recording the original ACL.
- Rotating krbtgt without preserving the previous hash and breaking your ticket.
- Ignoring 4662 and 5136 alerts that reveal ACL persistence.