A Skeleton Key attack patches the LSASS process on a domain controller in memory so that a single attacker-chosen master password authenticates as any account, while real passwords keep working so nothing looks broken. It is a stealthy domain-wide backdoor that needs Domain Admin to deploy and is cleared by a reboot. Defend by protecting LSASS (RunAsPPL), restricting Domain Admin, and monitoring DCs for the in-memory patch.
What a Skeleton Key attack is
When a domain controller checks a password, it does so inside the LSASS process. A Skeleton Key attack patches LSASS in memory so that, in addition to each account's real password, one master password the attacker picked also validates for everyone. Users notice nothing, because their own passwords still work, which makes the backdoor quiet.
How the attack works
With Domain Admin on a DC the attacker runs mimikatz misc::skeleton, which patches the running LSASS so the master password (a known default in the public tool) authenticates as any account. The attacker can then log in as any user with that one password. Because it lives only in memory, a reboot removes it, so attackers pair it with other persistence. Shown for defensive testing.
How to defend against it
Protect LSASS: enable RunAsPPL (Protected Process Light) and Credential Guard so the process is harder to patch, and restrict who holds Domain Admin, since the attack needs it. Monitor domain controllers for the memory patch and for logons that succeed with anomalous credentials, and reboot a DC suspected of being patched (which clears the in-memory backdoor) while you investigate.
References
- [1]MITRE ATT&CK Enterprise Matrix(MITRE ATT&CK)
- [2]Microsoft: Configuring additional LSA protection (RunAsPPL)(Microsoft)
One patched DC can quietly accept a master password for your whole domain. Talk to a security expert about hardening LSASS on your tier-0.