Shadow Credentials

Shadow Credentials abuse Active Directory Key Trust by adding an attacker-controlled public key to a target account's msDS-KeyCredentialLink. For user objects, the operator needs effective rights to write the attribute. For computer objects, MS-ADTS requires the requestor to be SELF with DS-Validated-Write-Computer and no existing value. The matching private key can then request a TGT for that account via PKINIT without its password. The credential persists until its specific value is removed; a password reset alone does not remove it.