ad cs shadow credentials detector — free browser tool | fatcousin

drop ad object diff + msds-keycredentiallink · detect shadow-cred attacks

input

drop ad object ldif/csv export

msDS-KeyCredentialLink attribute · LDIF or CSV diff

Select file

flags KeyCredentialLink on privileged accounts · non-AzureAD device refs · rapid credential link churn

limits

heuristic screener · KeyCredentialLink blob parse is best-effort · no live AD validation · not definitive proof

status

>ready