Directory Persistence

Expanded Definition

Directory persistence refers to a post-compromise technique in which an attacker preserves access by changing identity infrastructure, not just by holding onto one account. In active directory and similar directory services, that can include permission changes, delegated rights, replication settings, group memberships, trust relationships, or directory objects that quietly survive routine password resets and lockouts.

This matters because directory state often outlives individual credentials. A service account can be reset, yet an attacker who has altered ACLs, added hidden access paths, or abused privileged replication permissions may still retain control. In practice, the distinction between ordinary account compromise and directory persistence is important for investigators, because the latter usually indicates deeper administrative footholds and broader blast radius. Definitions vary across vendors, but the core idea is consistent: the attacker makes the directory itself part of the persistence mechanism. NIST’s control language around access enforcement and account management in NIST SP 800-53 Rev 5 Security and Privacy Controls provides useful grounding for how these privileges should be governed.

The most common misapplication is treating directory persistence as a simple password problem, which occurs when responders reset credentials without reviewing directory permissions, delegation paths, and replication-related changes.

Examples and Use Cases

Implementing detection and remediation for directory persistence rigorously often introduces operational overhead, requiring organisations to weigh faster recovery against the cost of deeper directory review and privilege mapping.

• An attacker adds a hidden group membership or delegated admin right so access remains after the compromised password is changed.
• A malicious change to replication permissions allows credential material to be extracted again later, even after the original endpoint is cleaned.
• Directory objects are modified so that a dormant backdoor reactivates when a scheduled task or privileged service account runs.
• Investigators find that a service account was “fixed,” but the attacker’s access survived because ACLs on critical objects were never restored.
• In a broader incident chain, stolen credentials are used as a foothold and the directory is then reshaped for long-term access, as seen in the Salt Typhoon US telecoms breach.

These patterns are especially important when organisations rely on hybrid identity estates, where directory changes may be replicated across multiple systems before defenders notice. Guidance from NIST SP 800-53 Rev 5 Security and Privacy Controls becomes actionable here because persistence often hides in control gaps, not in obvious malware artefacts.

Why It Matters in NHI Security

Directory persistence is a high-impact NHI security issue because service accounts, automation identities, and privileged integrations often depend on directory trust. When those trust relationships are altered, attackers can retain access across password rotation, incident response, and routine account cleanup. NHI Management Group research shows that only 5.7% of organisations have full visibility into their service accounts, which makes hidden directory changes far harder to detect and contain. The same visibility gap amplifies the risk of excessive privilege, especially when directory permissions are inherited, delegated, or rarely reviewed.

For NHI programs, the governance lesson is clear: access reviews must include directory objects, not just user-facing credentials. Monitoring should cover replication rights, privileged groups, shadow administration, and unexpected ACL changes, with investigation playbooks that assume persistence may survive simple remediation. The operational consequences also extend to third-party and cross-domain access, where a single directory modification can undermine trust boundaries far beyond the initial account compromise. A related pattern appears in the Salt Typhoon US telecoms breach, where stolen credentials were only part of the problem.

Organisations typically encounter directory persistence only after repeated re-entry or failed eradication attempts, at which point the directory itself has become operationally unavoidable to address.

Related resources from NHI Mgmt Group

• How should security teams prevent unwanted persistence in Active Directory and Entra ID?
• Why do machine and service accounts create persistence risk in Active Directory?
• Why do Active Directory service accounts complicate zero trust programs?
• How should security teams govern Active Directory service accounts?