domains / families / security / active-directory-certificate-services

active-directory-certificate-services

separate

AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to enrollment, CA officer abuse, and certificate-based persistence.

When to use

• ESC1-ESC13 template abuse
• NTLM relay to enrollment
• CA officer abuse
• certificate-based persistence
• AD CS enumeration
• privilege escalation via AD CS

Skill page

Source