Abuse of Active Directory Certificate Services

Misconfigured Active Directory Certificate Services templates, CA permissions, PKI directory objects, or HTTP enrollment endpoints can let an authorized user obtain an authentication certificate for an identity they should not control. The Certified Pre-Owned ESC1–ESC8 labels describe distinct paths: ESC1, enrollee-supplied subject on an enrollable authentication template; ESC2, an enrollable Any Purpose or no-EKU template without issuance requirements; ESC3, Certificate Request Agent enrollment without effective restrictions; ESC4, control of a certificate-template ACL; ESC5, control of vulnerable PKI Active Directory objects; ESC6, CA SAN-in-request behavior combined with applicable issuance settings; ESC7, dangerous CA permissions; and ESC8, NTLM relay to AD CS HTTP enrollment endpoints. These paths have different prerequisites and must not be conflated. A certificate request is not itself a forged certificate. The detailed steps below demonstrate one request-based ESC1 path; they do not execute ESC2–ESC8. Certificate abuse is categorized by ATT&CK under Credential Access and may also enable privilege escalation or persistence. Under current strong certificate mapping, a template finding or UPN in a request alone does not establish that the certificate will authenticate as another account.