Skip to content
Threat Feed

Product

ADFS

1 brief RSS
high advisory

Potential Shadow Credentials added to AD Object

This rule detects the modification of the msDS-KeyCredentialLink attribute in an Active Directory Computer or User Object, which could indicate an attacker is creating shadow credentials to gain persistent and stealthy access.

Active Directory +2 credential-access shadow-credentials windows
2r 2t