AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to enrollment, CA officer abuse, and certificate-based persistence.

SKILL: AD CS Attack Playbook — Expert Guide AI LOAD INSTRUCTION : Expert AD CS (Active Directory Certificate Services) attack techniques. Covers ESC1 through ESC13, certificate based persistence, NTLM relay to enrollment endpoints, and CA misconfigurations. Base models miss enrollment prerequisite chains and ESC condition combinations. 0. RELATED ROUTING Before going deep, consider loading: [active directory acl abuse](../active directory acl abuse/SKILL.md) for ACL based attacks that enable ESC4 (template modification) [active directory kerberos attacks](../active directory kerberos attacks/SKILL.md) for Kerberos techniques after obtaining certificates [ntlm relay coercion](../ntlm relay coercion/SKILL.md) for ESC8 (relay to HTTP enrollment endpoint) [windows lateral movement](../windows lateral movement/SKILL.md) for using obtained certificates for lateral movement Advanced Reference Also load [ADCS ESC MATRIX.md](./ADCS ESC MATRIX.md) when you need: ESC1–ESC13 quick reference table with conditions, impact, and tool commands One liner exploitation commands per ESC variant Detection indicators per technique 1. AD CS ARCHITECTURE OVERVIEW 2. ENUMERATION 3. ESC1 — ENROLLEE SUPPLIES SUBJECT Condition : Template allows enrollee to specify Subject Alternative Name (SAN) + client authentication EKU + low privilege enrollment. 4. ESC2 — ANY PURPOSE EKU Condition : Template has "Any Purpose" EKU or no EKU (subordinate CA cert) + low privilege enrollment. 5. ESC3 — ENROLLMENT AGENT Condition : Template allows enrollment agent certificate + another template allows enrollment on behalf of others. 6. ESC4 — TEMPLATE ACL MISCONFIGURATION Condition : Low privilege user has write access to certificate template object. 7. ESC6 — EDITF ATTRIBUTESUBJECTALTNAME2 Condition : CA has EDITF ATTRIBUTESUBJECTALTNAME2 flag enabled → any template becomes ESC1. 8. ESC7 — CA OFFICER / MANAGER PERMISSIONS Condition : User has ManageCA or ManageCertificates permission on the CA. 9. ESC8 — NTLM RELAY TO HTTP ENROLLMENT Condition : CA has HTTP enrollment endpoint (certsrv) without HTTPS enforcement. 10. ESC9 ESC13 — NEWER DISCOVERIES ESC9: No Security Extension (StrongCertificateBindingEnforcement = 0/1) Weak certificate mapping allows impersonation when CT FLAG NO SECURITY EXTENSION is set. ESC10: Weak Certificate Mapping (Registry based) Similar to ESC9 but exploits CertificateMappingMethods registry value on DC. ESC11: NTLM Relay to RPC Enrollment Relay NTLM to the CA's RPC interface (IF ENFORCEENCRYPTICERTREQUEST not set). ESC13: OID Group Link (Issuance Policy) Template's issuance policy OID is linked to a group → certificate grants that group membership. 11. CERTIFICATE BASED PERSISTENCE Golden Certificate With CA private key → forge any certificate. Persistence : Valid until CA certificate expires or CA private key is rotated. ForgeCert (Windows) 12. AD CS ATTACK DECISION TREE

active-directory-certificate-services