This note documents detection patterns related to Shadow Credentials within Active Directory environments.

Direct Indicators

Log	Event ID	Meaning	Forensic Value	Notes
Security	5136	Directory object modified	Critical	Modification of the msDS-KeyCredentialLink attribute is the primary indicator of Shadow Credential abuse.
Security	4662	Operation performed on object	High	LDAP write operation against user/computer object.
Security	4624	Successful logon	High	Logon may occur shortly after key credential is added.
Security	4768	Kerberos TGT request	High	Authentication using certificate-based Kerberos (PKINIT).
Security	4672	Special privileges assigned	High	Privileged sessions may appear if attacker targets admin accounts.
Sysmon	1	Process creation	Medium	Execution of tools such as Whisker or Certipy modifying AD attributes.
Sysmon	3	Network connection	Medium	LDAP communication with domain controller during attribute modification.

Indirect Indicators

Indicator	What To Look For	Forensic Value	Notes
Modification of msDS-KeyCredentialLink	Unexpected attribute added to user or computer object	Critical	Primary artifact of Shadow Credentials.
Certificate-based authentication without PKI usage	PKINIT authentication in environment without normal certificate auth	Critical	Strong indicator of abuse.
Authentication from unusual host	Account authenticating from workstation it normally does not use	High	Possible attacker-controlled host.
Rapid privilege escalation after modification	Admin actions shortly after attribute change	Critical	Indicates account takeover.
LDAP modifications from workstation	Directory modification initiated from non-admin host	High	Suspicious behavior.

Common Tools

Tool	Usage
Whisker	Adds shadow credentials to AD objects.
Certipy	Performs Shadow Credential attacks via msDS-KeyCredentialLink.
Impacket	LDAP scripts used for attribute manipulation.
PowerView	Used to modify AD attributes when permissions allow.
Rubeus	Used to request Kerberos tickets after credential injection.

Relevant Artifacts

Domain controller Security logs (5136, 4662, 4768)
Active Directory object metadata
LDAP modification logs
Sysmon logs (1, 3)
EDR telemetry identifying AD manipulation tools
Directory replication metadata
Prefetch artifacts showing execution of Certipy or Whisker
Kerberos authentication logs

MITRE ATT&CK References

T1556 Modify Authentication Process
T1550 Use Alternate Authentication Material
T1558 Steal or Forge Kerberos Tickets
T1078 Valid Accounts

Decision Tree

Is the suspicious event present?
- Identify directory modification (5136) on msDS-KeyCredentialLink.
What host generated the event?
- Determine workstation performing LDAP modification.
Is the account expected to perform this action?
- Investigate whether account normally manages certificate credentials.
Pivot:
- Source host → inspect execution of Certipy or Whisker.
- Target account → review privilege level and group memberships.
- Network → analyze Kerberos authentication events following modification.
Confirm exploitation
- Determine whether attacker injected a new key credential and authenticated via PKINIT.

Example Detection Templates

KQL

SecurityEvent
| where EventID == 5136
| where AttributeLDAPDisplayName == "msDS-KeyCredentialLink"

SecurityEvent
| where EventID == 4768
| summarize count() by TargetUserName, IpAddress, bin(TimeGenerated, 5m)

EQL

any where event.code == "5136"

Sigma

title: Suspicious msDS-KeyCredentialLink Modification
id: shadow-credentials-detection
status: experimental
description: Detects modification of msDS-KeyCredentialLink which may indicate Shadow Credential attack
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5136
    AttributeLDAPDisplayName: msDS-KeyCredentialLink
  condition: selection
fields:
  - SubjectUserName
  - ObjectDN
falsepositives:
  - Legitimate certificate enrollment systems
level: high
tags:
  - attack.persistence
  - attack.t1556

Mitigation & Hardening

Control Area	Mitigation	Effectiveness	Notes
Privilege review	Audit ACLs allowing modification of msDS-KeyCredentialLink	Critical	Remove unnecessary permissions.
Monitoring	Alert on msDS-KeyCredentialLink attribute changes	Critical	Primary detection mechanism.
PKI governance	Restrict certificate authentication usage	High	Limits attack surface.
Least privilege	Restrict who can manage authentication attributes	High	Prevents unauthorized modification.
EDR monitoring	Detect execution of Certipy or Whisker tools	High	Stops attacker tooling early.