Shadow Credentials

The Shadow Credentials backdoor technique exploits the legitimate Microsoft "Windows Hello for Business" feature. If the Active Directory does not use this feature, it is easy to detect this persistence mechanism. If it does use this feature, misconfigurations could indicate compromise or poor management practices.

Misconfigurations of key credentials in the Windows Hello for Business feature can have a significant impact on Active Directory security, potentially introducing alternative authentication methods. Therefore, it is imperative to give them thorough attention and supervision.

Name: Shadow Credentials

Codename: C-SHADOW-CREDENTIALS

Severity: High