An ESC3 path exists when an attacker can enroll in a published template that issues a Certificate Request Agent certificate and the CA permits that agent to request an authentication-capable certificate on behalf of an eligible target. Enrollment rights, CA Enrollment Agent Restrictions, target-template settings and issuance controls determine exploitability; merely finding the agent EKU does not establish full domain compromise.
Variant:
Create an authorized lab authentication certificate
powershell
RESTRICTED_ACCESS_BLUR_MARKER
RESTRICTED_ACCESS_BLUR_MARKER
RESTRICTED_ACCESS_BLUR_MARKER
RESTRICTED_ACCESS_BLUR_MARKER