Skeleton Key

Skeleton Key is malware used to inject false credentials into domain controllers with the intent of creating a backdoor password. [1] Functionality similar to Skeleton Key is included as a module in Mimikatz.

ID: S0007
Type: MALWARE
Platforms: Windows
Version: 1.2
Created: 31 May 2017
Last Modified: 06 February 2024

Techniques Used

Domain ID Name Use
Enterprise T1556 .001 Modify Authentication Process: Domain Controller Authentication

Skeleton Key is used to patch an enterprise domain controller authentication process with a backdoor password. It allows adversaries to bypass the standard authentication system to use a defined password for all accounts authenticating to that domain controller.[1]

Groups That Use This Software

ID Name References
G1023 APT5

[2]

References