Possible Shadow Credentials Added

calendar Oct 23, 2025 · attack.persistence attack.defense-evasion attack.credential-access attack.t1556  ·
Share on: linkedin copy

Detects possible addition of shadow credentials to an active directory object.

Sigma rule (View on GitHub)

 1title: Possible Shadow Credentials Added
 2id: f598ea0c-c25a-4f72-a219-50c44411c791
 3status: test
 4description: Detects possible addition of shadow credentials to an active directory object.
 5references:
 6    - https://www.elastic.co/guide/en/security/8.4/potential-shadow-credentials-added-to-ad-object.html
 7    - https://cyberstoph.org/posts/2022/03/detecting-shadow-credentials/
 8    - https://twitter.com/SBousseaden/status/1581300963650187264?
 9author: Nasreddine Bencherchali (Nextron Systems), Elastic (idea)
10date: 2022-10-17
11tags:
12    - attack.persistence
13    - attack.defense-evasion
14    - attack.credential-access
15    - attack.t1556
16logsource:
17    product: windows
18    service: security
19    definition: The "Audit Directory Service Changes" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule)
20detection:
21    selection:
22        EventID: 5136
23        AttributeLDAPDisplayName: 'msDS-KeyCredentialLink'
24        # If you experience a lot of FP you could uncomment the selection below
25        # There could be other cases for other tooling add them accordingly
26        # AttributeValue|contains: 'B:828'
27        # OperationType: '%%14674' # Value Added
28    # As stated in the FP sections it's better to filter out the expected accounts that perform this operation to tighten the logic
29    # Uncomment the filter below and add the account name (or any other specific field) accordingly
30    # Don't forget to add it to the condition section below
31    # filter:
32        # SubjectUserName: "%name%"
33    condition: selection
34falsepositives:
35    - Modifications in the msDS-KeyCredentialLink attribute can be done legitimately by the Azure AD Connect synchronization account or the ADFS service account. These accounts can be added as Exceptions. (From elastic FP section)
36level: high

References

  • Potential Shadow Credentials added to AD Object | Elastic Security [8.4] | Elastic

    Potential Shadow Credentials added to AD Object edit Identify the modification of the msDS-KeyCredentialLink attribute in an Active Directory Computer or User Object. Attackers can abuse control ov...


    Read More

  • Detecting shadow credentials :: Cyberstoph's blog — Cyberstoph's Blog

    A defenders perspective on msDS-KeyCredentialLink TL;DR; This article is about my journey into tracing changes to the msDS-KeyCredentialLink attribute to verify if their origin is legitimate or a potential attack (aka. Shadow Credentials). If you just want to know the “gist” of it, scroll down to the bottom and you’ll find a mindmap. What’s msDS-KeyCredentialLink and why should I care? The msDS-KeyCredentialLink (aka. “kcl”) attribute can be used to link an RSA key pair with a computer or user object in order to authenticate with said key pair against the KDC to receive a Kerberos TGT.


    Read More

  • Something went wrong, but don’t fret — let’s give it another shot. Some privacy related extensions may cause issues on x.com. Please disable them and try again.


    Read More

Related rules

to-top