Loading…
A comprehensive technical breakdown of Active Directory Certificate Services (ADCS) security architecture, analyzing ESC1/ESC8 misconfigurations, PowerShell auditing, enterprise hardening, an
Architect and deploy a production-grade Micro-SaaS platform with Next.js 16, Better-Auth, Drizzle ORM, and multi-tenant security controls.
25 min read
Complete practical lab guide to LLMNR/NBT-NS poisoning, NetNTLMv2 hash cracking with Hashcat rules, NTLM relaying to SMB/LDAP via ntlmrelayx, and Enterprise SIEM detection.
Basic understanding of Active Directory, Kerberos authentication, and Windows Event Logging.
Understand ADCS PKI mechanics, audit template misconfigurations with PowerShell, enforce EPA/HTTPS controls, and write KQL detection rules for SIEM.
Active Directory Certificate Services (ADCS) is the Public Key Infrastructure (PKI) foundation for modern Windows Enterprise environments. It facilitates identity verification, machine authentication, Smart Card logons, Code Signing, and SSL/TLS encryption across Active Directory domains.
However, default installations and improper management of Enterprise Certificate Authorities (CAs) often introduce high-severity security vulnerabilities. Misconfigured certificate templates and insecure web enrollment endpoints (such as NTLM relay targets) can allow unauthorized elevation of privilege across domain boundaries.
This guide details the structural security mechanics of ADCS misconfigurations—specifically focusing on ESC1 (SAN-based authentication abuse) and ESC8 (NTLM HTTP Relay to ADCS enrollment endpoints)—alongside concrete audit protocols, hardening standards, and production-ready KQL (Kusto Query Language) detection rules for Microsoft Sentinel and Defender for Endpoint.
Understanding ADCS risk requires mapping the critical lifecycle of an enterprise X.509 certificate within Active Directory:
pKIEnrollmentService & pKICertificateTemplate): Stored in the AD Configuration Naming Context (CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=...). Templates define EKUs (Extended Key Usages), enrollment permissions, and subject name generation policies.1.3.6.1.5.5.7.3.2)1.3.6.1.4.1.311.20.2.2)1.3.6.1.5.2.3.4)2.5.29.37.0)Vulnerability Mechanics: ESC1 occurs when an Enterprise CA publishes a certificate template that satisfies three simultaneous conditions:
Domain Users or Authenticated Users) to request certificates.CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT Enabled: The template flag allows the requester to supply an arbitrary Subject Alternative Name (SAN) in the Certificate Signing Request (CSR).Impact Analysis:
When ENROLLEE_SUPPLIES_SUBJECT is enabled alongside authentication EKUs, an authenticated domain user can submit a CSR specifying the User Principal Name (UPN) of a Domain Admin or privileged account in the SAN extension. The resulting X.509 certificate allows kerberos/NTLM authentication as the specified privileged account.
Vulnerability Mechanics: ESC8 leverages insecure authentication mechanisms on default ADCS HTTP enrollment interfaces:
/certsrv/) or Certificate Enrollment Service (CES) endpoints rely on NTLM authentication over HTTP.Impact Analysis:
An attacker relaying machine account credentials to /certsrv/ can obtain a valid machine authentication certificate signed by the CA, resulting in persistent computer account impersonation.
Security administrators can inspect Active Directory certificate templates directly using standard PowerShell cmdlets without relying on external tooling.
ENROLLEE_SUPPLIES_SUBJECT# Import Active Directory module
Import-Module ActiveDirectory
# Define Configuration NC Path
$configNC = (Get-ADRootDSE).configurationNamingContext
$templatesPath = "CN=Certificate Templates,CN=Public Key Services,CN=Services,$configNC"
# Query for templates where mPKI-Certificate-Name-Flag contains ENROLLEE_SUPPLIES_SUBJECT (0x00000001)
Get-ADObject -SearchBase $templatesPath -Filter * -Properties cn, displayName, "mPKI-Certificate-Name-Flag", "pKIExtendedKeyUsage" | ForEach-Object {
$flag = $_."mPKI-Certificate-Name-Flag"
if ($flag -and ($flag -band 1)) {
[PSCustomObject]@{
TemplateName = $_.cn
DisplayName = $_.displayName
EKUs = $_.pKIExtendedKeyUsage
EnrolleeSuppliesSubject = $true
}
}
}
To mitigate ESC1, ESC8, and related ADCS security risks, implement the following enterprise controls:
EnrolleeSuppliesSubject: Edit vulnerable templates via certtmpl.msc and uncheck "Supply in the request" under the Subject Name tab. Select "Build from this Active Directory information" instead.Domain Users, Authenticated Users) from sensitive templates./certsrv): If legacy ASP web enrollment (/certsrv) is not strictly required, uninstall the Web Enrollment role service from the CA./certsrv/. Set EPA to Required.Configure Microsoft Active Directory Domain Controller registry keys to enforce strong certificate mapping (KB5014754 enforcement mode):
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc]
"StrongCertificateBindingEnforcement"=dword:00000002
Deploy the following Kusto Query Language (KQL) rules within Microsoft Sentinel / Defender for Cloud Apps to monitor for suspicious certificate requests and authentication anomalies.
Monitors Active Directory Certificate Services Audit Log (Event ID 4887: Approved certificate request) for SAN additions containing high-privilege account names.
// Detect ADCS Certificate Issuance with Custom Subject Alternative Name (SAN)
SecurityEvent
| where EventID == 4887
| where ServiceName == "CertSvc"
| extend Attributes = parse_xml(EventData).EventData.Data
| mv-expand Attributes
| where Attributes["@Name"] == "Attributes"
| extend AttributeText = tostring(Attributes["#text"])
| where AttributeText has "san:" or AttributeText has "CertificateTemplate:"
| project
TimeGenerated,
Computer,
SubjectUserName,
SubjectDomainName,
AttributeText,
Activity
| order by TimeGenerated desc
Monitors Kerberos Authentication Service requests (AS-REQ) using PKINIT authentication certificate thumbprints where the requester identity differs from the certificate Subject.
// Monitor PKINIT Authentication Events for User Principal Name Anomalies
SecurityEvent
| where EventID == 4768 // Kerberos Authentication Ticket (TGT) Requested
| where TicketOptions has "0x40810000" or CertIssuerName != ""
| extend CertificateThumbprint = tostring(EventData.CertThumbprint)
| where isnotempty(CertificateThumbprint)
| project
TimeGenerated,
TargetUserName,
TargetDomainName,
ClientIPAddress,
CertIssuerName,
CertSerialNumber,
CertificateThumbprint
| Domain | Control Objective | Verification Method | Status |
|---|---|---|---|
| Templates | Audit ENROLLEE_SUPPLIES_SUBJECT on all Auth EKUs | PowerShell ActiveDirectory query | Mandatory |
| HTTP Endpoints | Enforce EPA & HTTPS on /certsrv / Disable unused endpoints | IIS Configuration Audit | Mandatory |
| DC Enforcement | Set KB5014754 StrongCertificateBindingEnforcement = 2 | Domain Controller Registry Audit | Critical |
| SIEM Detection | Enable Security Event 4886 & 4887 Auditing on Certificate Authorities | Windows Event Log Policy Audit | Operational |
Authored by Syed Zada Abrar | SentinelReign Cybersecurity Research Division
120 min read
A practical, step-by-step tutorial on identifying, requesting, extracting, and cracking offline password hashes for vulnerable Active Directory Kerberos service accounts.
35 min read