Misconfigured Certificate Templates

This example covers an ESC1-style Active Directory Certificate Services (AD CS) template misconfiguration under ATT&CK T1649: a domain user who can enroll at both the CA and template may be able to request an authentication-capable certificate with a requester-supplied subject or Subject Alternative Name for a different identity when manager approval and authorized-signature controls are absent. A successful request yields a certificate/private-key credential; issuance alone does not prove authentication or access. This entry focuses on template enrollment, not certificate-store theft, device-certificate export, CA-key forging, or enrollment-endpoint relay paths.