Certsync Activity

After a device has been compromised, an attacker can run Certsync to query LDAP to retrieve a set of users in the Active Directory domain and locate the AD CS server. Certsync creates a service on the AD CS server by sending a Microsoft remote procedure call (MS-RPC) request and receiving an MS-RPC response, which grants the attacker access to the certificate server’s private key. Certsync then remotely copies the private key and forges a new authentication certificate for each enumerated user. The attacker can perform the UnPAC-the-Hash technique to steal NTLM hashes and perform additional attacks, such as pass-the-hash, to access services and devices.