name: Shadow Credentials Followed by RBCD Configuration Attack Chain Analytic
signatureid: WEL-ACC02-AEI
category: 'Privilege Escalation'
threatname: 'Valid Accounts: Domain Accounts'
functionality: 'Microsoft Windows'
description: |
Detects a sophisticated privilege escalation attack chain where a user account first performs a Shadow Credentials
attack by modifying the msDS-KeyCredentialLink attribute, followed immediately by a machine account modifying the
msDS-AllowedToActOnBehalfOfOtherIdentity attribute to configure Resource-Based Constrained Delegation. This temporal
correlation indicates an attacker who has: (1) Compromised a user account with write permissions, (2) Used Shadow
Credentials to take over a machine account by adding key credentials, (3) Authenticated as that machine account using
the certificate, and (4) Configured RBCD from the compromised machine account to escalate privileges further. This
attack chain is highly indicative of advanced adversary techniques combining multiple privilege escalation methods.
The sequential nature within a short timeframe (typically minutes) strongly suggests malicious intent rather than
legitimate administrative actions.
reference:
- https://posts.specterops.io/shadow-credentials-abusing-key-trust-account-mapping-for-takeover-8ee1a53566ab
- https://www.thehacker.recipes/ad/movement/kerberos/shadow-credentials
- https://posts.specterops.io/another-word-on-delegation-10bdbe3cd94a
- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/resource-based-constrained-delegation-ad-computer-object-take-over-and-privilged-code-execution
labels:
- attack.privilege_escalation
- attack.t1078.002
- attack.credential_access
- attack.t1649
- attack.t1558.003
- attack.persistence
- attack.t1098
- Shadow_Credentials
- RBCD
- Attack_Chain
- Whisker
logsource:
product: Windows
service: Security
detection:
selection_shadow_creds:
BaseEventId: 5136
DisplayAccount: 'msDS-KeyCredentialLink'
DeviceAction: 'Value Added'
filter_shadow_creds_machine:
SourceUserName|endswith: '$'
selection_rbcd:
BaseEventId: 5136
DisplayAccount: 'msDS-AllowedToActOnBehalfOfOtherIdentity'
DeviceAction: 'Value Added'
rbcd_machine_user:
SourceUserName|endswith: '$'
condition: (selection_shadow_creds and not filter_shadow_creds_machine) or (selection_rbcd and rbcd_machine_user)
analytical_type:
aggregated_event_analytics:
filter: ~
distinct: ~
threshold_type: 'frequency'
number_of_occurrences: 2
within_duration: '00:05:00'
having_similar: devicehostname
consecutive_events: true
criticality: Critical
saveasthreat: false
violation_summary:
grouping_attribute: 'SourceUserName'
level2_attribute: 'ObjectDn'
level2_metadata_attributes:
metadata_attributes: 'DisplayAccount'TECHNICAL DETAILS
Attack chain timeline and technical details:
STAGE 1 - Shadow Credentials (Event 1):
Event ID: 5136
SourceUserName: compromised_user (NO '$' suffix - regular user account)
DisplayAccount: msDS-KeyCredentialLink
DeviceAction: Value Added
ObjectDN: CN=TARGET-MACHINE,CN=Computers,DC=domain,DC=local
What happened: Attacker used compromised user account with GenericWrite permissions to add
certificate credentials to a machine account, enabling authentication as that machine without
knowing its password.
STAGE 2 - RBCD Configuration (Event 2):
Event ID: 5136
SourceUserName: TARGET-MACHINE$ (WITH '$' suffix - machine account)
DisplayAccount: msDS-AllowedToActOnBehalfOfOtherIdentity
DeviceAction: Value Added
ObjectDN: CN=HIGH-VALUE-SERVER,CN=Computers,DC=domain,DC=local
What happened: Attacker, now authenticated as the compromised machine account (from Stage 1),
configures RBCD on a high-value target to enable impersonation of privileged users.
Attack flow:
1. Initial compromise: User account with GenericWrite on computer object
2. Shadow Credentials: Add key to target machine's msDS-KeyCredentialLink
3. Certificate authentication: Use Whisker/Rubeus to get TGT as machine account
4. RBCD configuration: As machine account, modify high-value target's RBCD attribute
5. Privilege escalation: Use RBCD to impersonate Domain Admin to high-value target
6. Lateral movement: Access sensitive systems with elevated privileges
Tools used in this attack chain:
- Stage 1: Whisker, pywhisker, PowerView (for Shadow Credentials)
- Stage 2: Rubeus, PowerView, Set-ADComputer (for RBCD)
Example commands:
# Stage 1: Shadow Credentials
whisker.exe add /target:TARGET-MACHINE$ /domain:domain.local
# Authenticate as machine account using certificate
rubeus.exe asktgt /user:TARGET-MACHINE$ /certificate:BASE64CERT /password:CERTPASSWORD /getcredentials
# Stage 2: RBCD Configuration (now running as TARGET-MACHINE$)
$SD = New-Object Security.AccessControl.RawSecurityDescriptor "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$((Get-ADComputer TARGET-MACHINE$).SID))"
Set-ADComputer HIGH-VALUE-SERVER$ -Replace @{'msDS-AllowedToActOnBehalfOfOtherIdentity'=$SD}
# Final stage: Abuse RBCD
rubeus.exe s4u /user:TARGET-MACHINE$ /impersonateuser:Administrator /msdsspn:cifs/HIGH-VALUE-SERVER.domain.local
Detection logic:
- First event: User account (no '$') modifying msDS-KeyCredentialLink
- Second event: Machine account (has '$') modifying msDS-AllowedToActOnBehalfOfOtherIdentity
- Timeframe: Within 5 minutes (allows time for cert auth and prep)
- Consecutive: Events should occur in this specific order
Policy building walkthrough can be found in this previous post: