Domain persistence
In this section, we will explore techniques to achieve persistence in the domain using a compromised CA. We will gain an understanding of the typical vectors an adversary will utilize to keep high-privileged access to the environment and explore approaches to detect such activities.
DPERSIST1 – Forge certificates with stolen CA certificate
If an adversary has compromised a CA and obtained a CA certificate with a corresponding private key, it is possible to forge any certificate in the domain environment. To differentiate the CA certificate from others, pay attention to certain characteristics such as the following:
- The issuer and subject are set to the distinguished name of the CA
- It has a “CA Version” extension
- No EKU
These characteristics are shown in the following screenshot:
Figure 8.44 – CA certificate information
It is important to mention that forged certificates cannot...
