Domain of Thrones: Part II

Written by Nico Shyne & Josh Prager

Introduction Part II

In the first installment of “Domain of Thrones,” we meticulously explored an array of six distinctive domain persistence techniques:

• Credential Theft on the Domain Controller (DC)


• NTDS Access


• DCSync


• Golden Ticket


• Diamond Ticket


• Active Directory Certificate Services (AD CS)

These adversarial methods facilitate an elevated level of access to the targeted domains, thereby challenging the defenders with a considerably strenuous eviction and remediation process.

Our initial post ended …

access active directory adversarial amp array blue team certificate certificate services controller credential credential theft cybersecurity detection engineering diamond diamond ticket directory domain domain controller golden golden ticket infosec introduction josh persistence services techniques theft threat hunting thrones ticket written