Account persistence

After an adversary gains an initial foothold, the next step is usually to establish persistence. In this section, we will only cover persistence techniques that rely on certificate usage.

PERSIST1 – Active user credential theft via certificates

Users can request a certificate from the CA in the environment for any available template that they are allowed to enroll in. An attacker will probably focus on templates allowing client authentication. An important caveat is that the template should not require manager approval or “authorized signatures” issuance requirements. This requirement defines how many digital signatures must be applied to the certificate request for approval. There is a default template called User, but it may be disabled. To find any other available templates, we can use a tool called Certify[9]. The following command will send LDAP queries and show available templates:

Certify.exe find /clientauth

The result of...