Skip to main content
PERSIST3 is a technique used to extend the lifetime of persistence obtained through PERSIST1 - User Persistence via Certificates or PERSIST2 - Machine Persistence via Certificates. Certificate templates have a Validity Period attribute that determines for how long an issued certificate can be used as well as a Renewal Period attribute that determines for how long an issued certificate can be renewed.

​
Understanding Certificate Validity and Renewal Periods

If we look at the User and Machine templates displayed in PERSIST1 or PERSIST2, we see that they have the default values for Validity Period (1 year) and Renewal Period (6 weeks). This effectively means that certificates issued from these templates can be used for 1 year, but can only be renewed in the first 6 weeks after being issued.
If you continuously renew a certificate before expiration of the Renewal Period, you can extend your persistence indefinitely.

​
Certificate Renewal Process

This can be done using the request-renew command from Certify.
Certificate renewal must be performed within the Renewal Period (typically 6 weeks) after the original certificate was issued. If this window expires, you will need to request a new certificate using the original PERSIST1 or PERSIST2 techniques.

​
Maintaining Indefinite Persistence

By setting up an automated process to renew certificates before the renewal period expires, an attacker can maintain persistence indefinitely, as long as:
  1. The certificate template remains available and unchanged
  2. The user or machine account retains enrollment rights
  3. The Certificate Authority remains accessible
  4. The renewal is performed within the designated renewal period
Consider automating the renewal process to ensure persistence is maintained without manual intervention. This can be achieved through scheduled tasks or other automation mechanisms.