TA0003 · PERSISTENCE
Reversible Encryption
An adversary may abuse Active Directory authentication encryption properties to gain access to credentials on Windows systems.
Detect it with
Monitor property changes in Group Policy: Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy\Store passwords using reversible encryption . By default, the property should be set to Disabled.
Why it matters on shift
Reversible Encryption is one of the concrete ways adversaries achieve persistence. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After persistence, the next tactic is usually Privilege Escalation. Search your telemetry for the transition before closing the ticket.
Kill-chain context