Shadow Credentials msDS-KeyCredentialLink Modification

Lacey Cochrane@NullVectorX

•updated Aug 5, 2026•9•0•6

Detects modifications to the 'msDS-KeyCredentialLink' attribute on user or computer objects within Active Directory. This attribute is targeted in 'Shadow Credentials' attacks (e.g., using tools like Whisker, pyWhisker, or DSInternals) to add an attacker-controlled public key, allowing for PKINIT-based authentication as the victim account without knowing the password.