AD CS Abuse: When Your Certificate Authority Becomes a Backdoor

Active Directory Certificate Services (AD CS) abuse turns an organisation’s own PKI into a privilege-escalation and persistence engine. The attack surface was systematised in 2021 by SpecterOps researchers Will Schroeder and Lee Christensen in their Certified Pre-Owned white paper, which catalogued a series of escalation paths labelled ESC1 through ESC8 (the community has since added more). The common thread: a misconfigured certificate template or CA setting lets a low-privileged user enrol for a certificate that authenticates as a higher-privileged account — often a domain administrator — after which the attacker holds durable, PKI-blessed access.

How It Works

Certificates can be used to authenticate to Active Directory. If a certificate template lets unprivileged users enrol and supply an arbitrary subject (the ENROLLEE_SUPPLIES_SUBJECT flag) with a client-authentication EKU, an attacker can request a certificate naming a domain administrator and then log in as them — the canonical ESC1 path. Other paths abuse dangerous EKUs, vulnerable CA ACLs, the CA’s own configuration, or relay of machine authentication to the CA’s web-enrolment endpoint (ESC8, an NTLM-relay path). Because a valid certificate can far outlive a password reset, certificate-based persistence is hard to evict. T1649 T1556 T1078

Tooling

The enumeration and exploitation are automated by open-source tools — Certify (C#) and Certipy (Python) — which find vulnerable templates, request malicious certificates and convert them into Kerberos tickets or NTLM material. Defensive enumeration is available through PingCastle, PSPKIAudit and Certipy’s own audit mode.

MITRE ATT&CK Mapping

Detection & Mitigation

• Audit certificate templates: remove ENROLLEE_SUPPLIES_SUBJECT where not required, restrict enrolment and client-auth EKUs, and require CA manager approval for sensitive templates.
• Harden the CA: enable Extended Protection for Authentication and disable NTLM on the web-enrolment endpoints to close ESC8, and tighten CA and template ACLs.
• Monitor AD CS issuance events (certificate requests and issuance, especially with mismatched subject/requester) and alert on certificate-based logons for privileged accounts; enforce the strong certificate-mapping updates from Microsoft’s KB5014754 guidance.
• Run PSPKIAudit, PingCastle or Certipy audit regularly to find and fix misconfigurations before an attacker does.