Threading the Needle: Detecting AD CS Abuse Through Decryption

Introduction

Active Directory Certificate Services (AD CS) is a prime target for attackers. It manages the cryptographic trust for an entire organization, yet a single misconfiguration provides an adversary with a fast track to gain persistent access, harvest credentials, and domain-level privilege escalation.

AD CS attacks hide in plain sight because Active Directory (AD) natively relies on encrypted protocols. Tools like Certipy and Metasploit abuse these standard communication paths to mimic routine system administration. Without a way to look inside those packets, defenders face a challenge of separating legitimate administrative tasks from nefarious actions.

Network decryption exposes these hidden actions. Unwrapping the protocol layer allows defenders to observe the actual behaviors buried inside the traffic, giving them the context needed to distinguish malicious activity from routine administration.

The AD CS Escalation Techniques (ESC1-ESC17)

SpecterOps’s 2021 whitepaper Certified Pre-Owned first documented eight AD CS configuration flaws which enables attackers to escalate (ESC) their privileges. As of mid-2026, there are 17 recognized escalation abuse scenarios.

Image 1: General overview of AD CS ESC Techniques.

Reconnaissance and LDAP Enumeration

Before AD CS can be exploited, an attacker needs to locate vulnerable Certificate Authorities (CAs) and misconfigured certificate templates [T1649]. They generally hunt for two specific structural flaws:

• Weak Issuance Controls: Permissive template access that allows arbitrary users to request certificates.
• Identity Spoofing Vulnerabilities: Templates that allow the requester to supply an arbitrary Subject Alternative Name (SAN), permitting them to masquerade as an administrator.

Attackers can automate this mapping [T1087] phase using tools like Certipy or Metasploit. These tools fire rapid, structured LDAP (port 389) or LDAPS (port 636), looking for the pKICertificateTemplate object class and filtering for high-value attributes like msPKI-Certificate-Name-Flag and pkiExtendedKeyUsage.

Image 2: Example of an attacker using Certipy to find vulnerable certificate templates.

Over an LDAPS connection, this reconnaissance looks identical to a standard stream of TLS packets. A firewall or traditional endpoint agent sees a client talking to a Domain Controller (DC). However, automated tools possess a behavioral pattern (timing, volume, and origin characteristics) that differs significantly from normal administration patterns.

Image 3: Without decryption capabilities, visibility into the context is hidden in LDAPS traffic.

Network decryption reveals the precise searchRequest sequences. Exposing these automated, sweeping queries allows defenders to immediately flag the reconnaissance phase and assess their network for further exploitation behaviors.

Image 4: Decrypted LDAPS shows the AD enumeration from Certipy’s searchRequest.

Image 5: ExtraHop RevealX AD Certificate Template Enumeration Activity

Authentication Coercion and NTLM Relay

If the initial sweep does not turn up an easily exploitable template, an attacker can pivot to authentication relay tactics, specifically techniques like ESC8 and ESC11. Both methods rely on intercepting NTLM authentication [T1557], but they target different unprotected AD CS interfaces.

The Attack Footprint

The attacker begins by using a coercion tool (like PetitPotam) to trigger specific RPC calls. This forces a high-value asset, like a DC, to authenticate to an attacker-controlled machine. Once triggered, the attacker acts as an inline proxy, relaying the three-way NTLM handshake to the CA server in real time.

Image 6: Coercing the DC to Authenticate to an Attacker-Controlled Machine.

The attacker leverages this hijacked session based on the specific vulnerability present on the AD CS interface:

• ESC8 (Web enrollment relay): This occurs when web enrollment interfaces fail to mandate HTTPS with Extended Protection for Authentication (Channel Binding). The attacker redirects the NTLM authentication to the /certsrv/ endpoint to obtain a certificate for the impersonated identity.
• ESC11 (RPC relay): This occurs when the CA’s RPC interface lacks packet-level encryption. The attacker relays the NTLM credentials directly to the ICertPassage (MS-ICPR) RPC interface to secure a certificate under an impersonated identity.

NTLM relay traffic blends perfectly into daily network authentication patterns. Tracking network sessions at the protocol layer allows defenders to monitor traffic directed at HTTP web enrollment and RPC interfaces to detect the underlying relay behavior.

Image 7: RevealX NTLM Relay Detection

Certificate Enrollment and Mapping Exploitation

The attacker requests a certificate to use for authentication or persistent access after establishing a path to the CA.This is the point where misconfigurations such as ESC1 become directly exploitable.

The Attack Footprint

The adversary uses their access to exploit several core configuration vulnerabilities:

• Abusive Certificate Enrollment (ESC1 and ESC17): ESC1 allows an attacker to supply a Domain Administrator's User Principal Name (UPN) to impersonate a user for domain authentication (Client Authentication EKU) [T1649]. ESC17 allows an attacker to supply an internal hostname (like a WSUS or Exchange server) to impersonate a server for TLS spoofing (Server Authentication EKU).
• Control Plane Manipulation (ESC4, ESC5, and ESC7): If attackers possess overly permissive modification rights over templates, PKI objects, or the CA itself, they change the AD CS configuration directly. This allows them to weaken approval requirements or grant themselves enrollment rights.
• Identity Spoofing & Weak Mappings (ESC9, ESC10, ESC14 and Certifried): These techniques target certificate-to-account mapping behavior. For example, in a Certified (CVE-2022-26923) exploit, an attacker modifies a compromised computer’s identity attributes, enrolls for a certificate, and relies on weak mapping logic to authenticate [T1098] as a high-privileged DC.

Administrators who attempted to mitigate ESC1 by switching the EKU from Client to Server Authentication, without disabling the "Enrollee Supplies Subject" flag, may have unknowingly created an ESC17 vulnerability. Additionally, attackers can pair ESC17 with DNS Zone Dynamic Update abuse to achieve a man-in-the-middle (MitM) attack and bypass HTTPS protections.

During enrollment, traditional network metadata only shows a baseline connection to a CA. Decrypting the RPC or LDAPS traffic lets defenders observe the actual attributes in transit. This exposes anomalous write commands to template objects or suspicious cross-protocol mapping abuse.

Credential Theft via UnPAC-the-Hash

If an attacker finds the AD CS templates are secure, they can pivot to a technique called UnPAC-the-Hash, which converts certificate-based access into an NTLM hash. To execute this technique in a Kerberos environment using the PKINIT[1] protocol, the attacker only needs a compromised user account with permission to enroll in a standard, non-vulnerable template.

The Attack Footprint

UnPAC-the-Hash abuses legitimate Kerberos features designed for legacy application compatibility. This entire sequence utilizes standard AD features and rarely triggers traditional operating system event logs.

Image 8: UnPAC-the-Hash Technique

The attack evades event logs but leaves a distinct network signature. Decrypting the Kerberos traffic exposes the internal flags within the ticket exchanges. RevealX analyzes this traffic to flag the UnPAC-the-Hash technique, identifying its anomalous protocol fingerprint: an immediate, unusual pairing of a PKINIT authentication request followed by a User-to-User TGS-REQ.

Image 9: RevealX UnPAC-the-Hash Activity Detection

Amplifying the Attack: NTDS Dumping via CertSync

An attacker with a fully compromised Enterprise CA can use tools (like CertSync) to forge Golden Certificates offline and retrieve domain credentials at scale. This tooling does not perform a traditional AD database (NTDS) dump [T1003.003] or a DCSync[2] [T1003.006] operation. Certsync abuses access to the CA private key to forge certificates for AD principals, authenticate via Kerberos PKINIT, and recover password hashes through a mass UnPAC-the-hash technique. Because this workflow does not copy NTDS.dit or invoke DRSUAPI[3] replication, detections focused only on classic NTDS dumping or DCSync indicators may not trigger.

Image 10: CertSync Automated Discovery to Credential Extraction

Kerberos ticketing traffic is common in the enterprise environment, making it easy for these authentication requests to blend in. Because CertSync builds the Golden Certificates [T1649] offline, the CA server never receives a standard enrollment request, thus host-based CA logs are not generated.

Many security controls cannot distinguish a legitimate user requesting a service ticket from an attacker using automated utilities to harvest hashes. Network decryption exposes the inner structures of Kerberos ticket requests, allowing analysts to identify the UnPAC-the-Hash pipeline and detect domain-wide credential extraction.

Image 11: RevealX CertSync Activity Detection

Conclusion

AD CS remains a valuable target because it is widely deployed, trusted by AD, and can be easily overlooked when securing the Windows environment. Attackers can use native authentication and directory protocols to enumerate certificate templates, coerce authentication, request certificates, and abuse certificate mappings.

These behaviors can resemble normal administrative traffic, especially when they occur over encrypted protocols. Endpoint and log-based defenses may miss parts of the attack lifecycle when protocol details are encrypted, incomplete, or not logged.

Decrypting and analyzing east-west traffic at the protocol layer exposes the behaviors attackers rely on, including template enumeration, suspicious Kerberos flags, misconfigured certificate mappings, and CertSync activity. RevealX provides that visibility passively, enabling defenders to separate routine AD CS administration from unauthorized activity.

AD CS Abuse Techniques Mapped to ExtraHop Detections

Behavioral Hunting Techniques

While network decryption provides insights into malicious activity, defenders can cross-reference these alerts with host-based audit logs for a defense-in-depth investigation.

1. Anomalous Post-Issuance Authentication (ESC1)

An attacker successfully requests a certificate using an identity spoofing vulnerability and subsequently uses it for authentication.

• Monitor the sequence of Event ID 4887 immediately succeeded by Event ID 4768 in which the issued subject users matches the target user occurring in a 60-minute window.

2. Access Control Modification (ESC4, ESC7)

Attackers with write privileges will attempt to alter secure template configurations to make them exploitable.

• Look for Event ID 5136 or 4662 where the object_dn attribute targets the "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration" path.
• Prioritize modifications to certificate template objects under CN=Public Key Services,CN=Services,CN=Configuration as well as forest-level PKI objects such as CN=NTAuthCertificates, CN=AIA and CN=CDP.

3. CA-Level Configuration Manipulation (ESC6, ESC11, ESC16)

Attackers with administrative access to the CA may modify global settings to permit user-supplied SANs or alter security extensions

• Monitor Specific Security Event IDs: 4882, 4885, 4890, 4891, and 4892
• Alternatively, look for Event ID 5136 in conjunction with modifications to the pKIEnrollmentService or certificationAuthority object classes.

4. Web Enrollment Relay Signatures (ESC8)

Relayed NTLM traffic targeting web interfaces leaves distinct infrastructure anomalies.

• Search IIS web request where the URI Path contains /certsrv/, the authentication type is NTLM and from an unknown admin host
Correlated with:
  CA Event ID 4886 or 4887 where the requester account is the same as the IIS authenticated account occurring within 5 minutes.

5. Weak Account Mappings (ESC14)

Attackers modify account attributes to force a certificate they own to map directly to a target account.

• Look for Event ID 5136 where the attribute_modified targets altSecurityIdentities.
  Correlated with:
  An anomalous altSecurityIdentities modification immediately followed by certificate-based authentication occurring within a 24-hour window.

6. DNS Zone Manipulation and TLS Spoofing (ESC17)

ESC17 relies on a low-privileged user requesting a Server Authentication certificate and downgrading a DNS zone to accept unauthenticated updates to execute a MitM attack.

• DNS Zone Downgrade: Look for Event ID 5136 AND a modified attribute of dNSProperty.
• Suspicious Server Auth Request: Event ID 4887 AND the requester account type is User AND the Certificate EKU is Server Authentication.
• SAN Mismatch: Search for CA Issuance Logs where the SAN is NOT the same as the  Requester Identity.

Resources

• Cato Networks: Cato CTRL™ Threat Research: Preventing Privilege Escalation via Active Directory Certificate Services (ADCS)
• ExtraHop: PetitPotam: Expanding NTLM Relay Attacks
• SpecterOps: Certified Pre-Owned, Certify Documentation
• Silverback Cyber:  How Certificates became AD’s Biggest Attack Surfaces
• Microsoft: Active Directory Certificate Overview, Security assessment: Certificates, 3.2.1.4.2 ICertRequestD, [MS-WCCE]: Windows Client Certificate Enrollment Protocol,
• Mustafa Durukan: ESC17: From ADCS Misconfiguration to WSUS Client Compromise via DNS Zone Abuse
• NCC Group: Defending Your Directory: An Expert Guide to Fortifying Active Directory Certificate Services (ADCS) Against Exploitation
• Palo Alto Networks: Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools
• Pypi: CertSync
• Sentinel One: CVE-2022-26923: Windows 10 Privilege Escalation Vulnerability
• The Hacker Recipes: Certified

[1]   Public Key Cryptography for Initial Authentication in Kerberos (PKINT)

[2] DCSync is an attack technique used to extract sensitive password hashes directly from AD by mimicking a legitimate DC.

[3] Directory Replication Service Remote Protocol (DRSRP) is the underlying Windows API and protocol that enables DCSync.