AD object with modified msDS-KeyCredentialLink

This modification directly enables persistent access to a target user or computer, allowing attackers to bypass normal authentication controls by creating a key pair and encrypting pre-authentication data using the client's private key.

Attackers can use this persistent access to launch further attacks, such as encrypting pre-authentication data using the client's private key and decrypting it on the KDC side, effectively bypassing normal authentication controls.

Cayosoft Guardian continuously monitors changes to the kcl attribute across Active Directory and flags modifications as security issues for administrators to investigate and take corrective action, providing visibility into potential attack paths.

Cayosoft Guardian provides alerts when unwanted changes occur, allowing administrators to undo them using Change History and limit the attacker's ability to create persistent access points.