skills.rest
blacklanternsecurity
blacklanternsecurityOFFICIAL
Explore all skills by this author →
WebsiteGitHub

ad-persistence

Establish persistent Active Directory access using DCShadow, Skeleton Key, and Golden SAML.

253|37|Updated Feb 22, 2026
Search Tags:#persistence#post-exploitation#mimikatz#red teaming#active directory#domain compromise
One-click install
npx skills add https://github.com/blacklanternsecurity/red-run --skill ad-persistence
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ad-persistence
Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/ad/ad-persistence
Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill ad-persistence

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps penetration testers maintain access within Active Directory environments after initial compromise, ensuring continued access for further operations.

Core Features & Use Cases

  • Diverse Persistence Techniques: Implements multiple methods like Golden Certificates, DCShadow, Skeleton Key, Custom SSPs, Security Descriptor Backdoors, and ADFS Golden SAML.
  • Stealth and Resilience: Offers options ranging from highly stealthy, long-term persistence to quicker, less stealthy methods, catering to different operational needs.
  • Use Case: After gaining Domain Admin privileges, use this Skill to deploy a Golden Certificate to ensure long-term, undetectable access to critical domain resources, even if passwords change.

Quick Start

Use the ad-persistence skill to deploy a Golden Certificate for the administrator user.

Frequently Asked Questions about ad-persistence

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I maintain persistent access in Active Directory after domain compromise?▼

Active Directory persistence is maintained after domain compromise using techniques like DCShadow, Skeleton Key, custom SSP injection, and Golden Certificates to ensure continued access even if passwords change.

What is a Golden Certificate and how does it work for AD persistence?▼

A Golden Certificate is a certificate-based persistence technique that grants long-term, undetectable access to critical domain resources after Domain Admin privileges are obtained, remaining effective even through password resets.

Do I need Domain Admin privileges to establish Active Directory persistence?▼

Yes, establishing AD persistence requires Domain Admin or SYSTEM access on Domain Controllers, along with specific tools like Mimikatz, Certipy, and ADFSDump to execute techniques such as DCShadow and ADFS Golden SAML.

What is the best way to deploy stealthy long-term persistence in a compromised domain?▼

The best stealthy persistence methods for a compromised domain include deploying Golden Certificates, SID history persistence, and security descriptor backdoors, which offer long-term, undetectable access compared to quicker, less stealthy techniques.

Can I use Mimikatz for Active Directory persistence techniques like Skeleton Key?▼

Yes, Mimikatz is used for Active Directory persistence techniques like Skeleton Key and custom SSP injection, allowing attackers to maintain stealthy backdoor access across Domain Controllers after initial compromise.

What are the limitations of using DCShadow for domain persistence?▼

DCShadow provides highly stealthy domain persistence by registering a rogue Domain Controller, but it requires Domain Admin privileges and is less suited for quick operations compared to simpler techniques like Skeleton Key.

Related Skills

Explore More Software Engineering Skills→
blacklanternsecurityblacklanternsecurity
253

kerberos-ticket-forging

Forge Golden, Silver, Diamond, and Sapphire Kerberos tickets using key materials.

Official
Advanced
jcastillotxjcastillotx

Linux Privilege Escalation

Enumerate Linux systems for privilege escalation paths to root.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

adcs-persistence

Automate AD CS persistence via Golden Certificate forging and certificate theft.

Official
Advanced
rahmatullahbossrahmatullahboss

Active Directory Attacks

Test Windows Active Directory security with reconnaissance, credential extraction, and Kerberos attacks.

Community
Advanced