Research Update Enhanced src/windows-hardening/active-direct...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL:
• Blog Title: Research Update Enhanced src/windows-hardening/active-directory-methodology/ad-certificates/account-persistence.md
• Suggested Section: Research

🎯 Content Summary

Research Update for src/windows-hardening/active-directory-methodology/ad-certificates/account-persistence.md

This PR contains automated research updates including:

• Latest security vulnerabilities and attack vectors
• Updated techniques and tools
• Enhanced explanations and examples
• Additional references and resources

Generated by: HackTricks Research Agent
Timestamp: 2026-04-01 03:28:02 UTC

Tool usage

• brave_search: 13
• exec: 19
• search_google_web: 2
• task_steps_m...

🔧 Technical Details

Research update for HackTricks content

🤖 Agent Actions

Reading the target page first, then I’ll compare nearby AD CS documentation so the update stays specific to account persistence and doesn’t duplicate other certificate pages.
The page is already fairly mature, so I’m narrowing the gap: related HackTricks pages next, then recent research to find additions that are specific to persistence rather than escalation or theft.
I have the local overlap mapped. Now I’m looking for post-2023 material that changes how account persistence actually works in practice: enforcement-era mappings, renewal behavior, and certificate-auth tooling across PKINIT and Schannel.
The current candidate additions are becoming clearer: one practical gap is Schannel/LDAPS use of persisted certificates when PKINIT is blocked, and another is stronger operator guidance around explicit mappings under the post-February 11, 2025 enforcement model.
I have enough material to make a targeted update. Before editing, I’m pinning down exact command forms so the additions stay executable rather than hand-wavy.
I’m editing the target file now. The changes are limited to account-persistence tradecraft: strong mapping string construction, computer-object persistence, and Schannel use of persisted certificates when PKINIT is unavailable.
Updated account-persistence.md.

I added practical persistence details around altSecurityIdentities and enforcement-era certificate auth:

• a Schannel/LDAPS fallback with certipy auth -ldap-shell for persisted certs when PKINIT is unavailable
• a new subsection showing how to extract Issuer, Serial, and SKI from a PFX and build strong mappings
• a note that explicit mappings also persist access to computer objects, not just users
• Enrollment Agent operational notes covering reuse with -on-behalf-of plus later renewal and Schannel use
• two new references relevant to explicit mapping abuse and certificate auth without PKINIT

URLs used during research:

• https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16
• https://specterops.io/blog/2024/02/28/adcs-esc14-abuse-technique/
• https://posts.specterops.io/certificates-and-pwnage-and-patches-oh-my-8ae0f4304c1d
• https://github.com/ly4k/Certipy/wiki/08-%E2%80%90-Command-Reference
• https://github.com/ly4k/Certipy/wiki/07-%E2%80%90-Post%E2%80%90Exploitation
• https://offsec.almond.consulting/authenticating-with-certificates-when-pkinit-is-not-supported.html
• https://www.thehacker.recipes/ad/movement/schannel/passthecert
• https://docs.specterops.io/ghostpack-docs/Certify.wik-mdx/esc14-explicit-certificate-mapping
• https://sudo-ad.fr/en/2025/06/18/ad-cs-and-certificate-mapping-updated-february-11-2025/

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post:

Content Categories: Based on the analysis, this content was categorized under "Research".

Repository Maintenance:

• MD Files Formatting: 964 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0