PowerShell script that aim to help uncovering (eventual) persistence mechanisms deployed by a threat actor following an Active Directory domain compromise
When I try to run your code in my test env (DC=87, Client using Powershell 7.3), i found some issues:
The $SchemaClass (Microsoft.ActiveDirectory.Management.ADEntity.ADObject) value cannot access with something like $SchemaClass["Name"].Value. It return $null. When I debugged the code, I found that just $SchemaClass["Name"] was enough.
In these line: $SchemaClassACL = New-Object System.DirectoryServices.ActiveDirectorySecurity; $SchemaClassACL.SetSecurityDescriptorSddlForm($SecDescriptorAsSDDL);
The SetSecurityDescriptorSddlForm method cannot run inside Parallel. I debug and found that the ssdl was ok, ran inside other powershell -> OK. Well, I changed the code to not run with Parallel -> It work.