Code-Signing Certificate Abuse via AD CS

Adversaries may create, acquire, or steal code-signing materials to sign malware or tools. Active Directory Certificate Services (AD CS) is one possible source: overly permissive enrollment or weak issuance controls can enable unauthorized certificate issuance, while a compromised signing private key can enable misuse of the certificate. Template settings alone do not prove abuse. This entry provides a defensive exposure and telemetry review and does not document enrollment, private-key export, or payload-signing steps. The template, CA issuance-event, and signer checks are independent, complementary evidence paths; no step's output is a prerequisite for another.