Shadow Credentials Bypass

Abuse delegated rights to add an attacker-controlled Key Credential to the msDS-KeyCredentialLink attribute of an Active Directory user or computer account. When the directory schema contains msDS-KeyCredentialLink, the KDC runs on a Windows Server 2016 or later domain controller, and that DC holds a server-authentication certificate, the corresponding private key can be used for PKINIT to request a TGT as the target account. This is account manipulation, not a password reset; preserve legitimate passwordless credentials.