AD CS Abuse (ESC1/ESC8): Detect & Stop Admin Forgery — Akuity SOC

In Microsoft Active Directory (AD) enterprise environments, Active Directory Certificate Services (AD CS) provides the critical Public Key Infrastructure (PKI). However, it also represents one of the most severe privilege escalation vectors tracked under MITRE ATT&CK technique T1649. Through architectural vulnerabilities such as ESC1 and ESC8, an unprivileged domain user can request or forge a client authentication certificate and escalate to Domain Admin within seconds.

Anatomy of ESC1 and ESC8 Attack Vectors

Both attack primitives leverage Kerberos PKINIT (Public Key Cryptography for Initial Authentication) to exchange a signed certificate for a full-privilege Kerberos Ticket Granting Ticket (TGT):

• ESC1 (Misconfigured Certificate Templates): Occurs when a published certificate template grants enrollment permissions to standard users, sets the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag (allowing the requester to inject a custom Subject Alternative Name), and includes Client Authentication or Smart Card Logon EKUs. An attacker requests a certificate specifying a Domain Admin or Enterprise Admin UPN as the SAN.
• ESC8 (NTLM Relay to AD CS Web Enrollment): The legacy AD CS HTTP enrollment endpoint (typically exposed at http://<CA_SERVER>/certsrv/) frequently lacks SMB signing, HTTP Extended Protection for Authentication (EPA), and channel binding. Attackers coerce authentication from a domain controller (e.g., via PetitPotam/MS-RPRN) and relay this NTLM exchange directly to the AD CS web interface to generate a valid domain controller certificate.

The Native Telemetry Blind Spot

When the forged X.509 certificate is presented to a domain controller during a Kerberos AS-REQ exchange, native Windows security logs record standard event IDs (such as 4624 or 4768) identical to legitimate smart card or PAW logons. Without integrated telemetry from Defender for Identity and continuous inspection of authentication payloads, distinguishing malicious PKINIT sessions from administrative baselines remains practically impossible.

Advanced Hunting KQL Detection

SOC analysts can query Microsoft Defender XDR using this Advanced Hunting (KQL) rule to identify abnormal certificate-based authentications targeting administrative or machine accounts from unapproved workstations:

IdentityLogonEvents
| where Protocol == "Kerberos" and ActionType == "LogonSuccess"
| extend ExtFields = todynamic(AdditionalFields)
| where tobool(ExtFields.IsCertBasedAuth) == true
| extend CertThumbprint = tostring(ExtFields.CertThumbprint),
         CertIssuer = tostring(ExtFields.CertIssuer),
         SubjectName = tostring(ExtFields.CertSubjectName)
| where AccountName in~ ("Administrator", "krbtgt") 
     or AccountName endswith "$"
| lookup kind=leftouter (IdentityInfo | summarize AdminGroups = make_set(GroupMembership) by AccountName = AccountUpn) on AccountName
| where AdminGroups has_any ("Domain Admins", "Enterprise Admins") or AccountName endswith "$"
| where not(IPAddress in ("127.0.0.1", "::1") or DeviceName endswith ".paw.domain.local")
| project Timestamp, AccountName, DeviceName, IPAddress, CertThumbprint, CertIssuer, SubjectName, AdminGroups

SOAR Remediation with Akuity SOC

Remediating identity-centric PKI compromises requires surgical containment to prevent domain persistence without causing operational disruption:

• X.509 Opacity Resolution: The Akuity SOC in-app AI assistant decodes certificate properties, SAN parameters, and PKINIT extensions in under 2 seconds directly within the incident timeline, eliminating dangerous copy-pasting into public online decoders (zero CyberChef data leaks).
• 1-Click SOAR Response: Instant execution of confirmUserCompromised() and revokeSessions() in Microsoft Entra ID and Active Directory to evict attacker sessions, combined with isolateDevice() across the relay source host via Defender for Endpoint.
• Zero-Trust Governance: Every automated containment action enforces strong MFA AAL2 authorization and writes an immutable audit record fulfilling NIS 2 and SOC 2 Type II compliance standards.

Technical FAQ

What is the architectural difference between ESC1 and ESC8?

ESC1 abuses a misconfigured template that permits arbitrary Subject Alternative Names directly to authenticated users. ESC8 is a network relay vector targeting an unprotected AD CS HTTP web enrollment portal, allowing attackers to coerce and relay machine accounts without requiring template misconfigurations.

How can organizations remediate the ESC8 attack path?

Remove the AD CS Web Enrollment role (IIS /certsrv) if not business-critical. If necessary, enforce Extended Protection for Authentication (EPA), enable HTTPS with Channel Binding Tokens, and disable NTLM authentication on the web enrollment IIS application in favor of Kerberos.