Skip to content
Start with Identity
Join free
SWI-T017 · Directory and trust

AD CS certificate template abuse

A certificate template with permissive enrollment rights or a misconfigured extension turns Active Directory Certificate Services into a path to domain compromise, no password or Kerberos ticket required.

TargetedHard to detect
First observed: 2021ATT&CK T1649 ↗

AD CS certificate template abuse is the use of a misconfigured Active Directory Certificate Services template, or the enrollment service around it, to obtain a certificate that authenticates as someone more privileged. A domain controller accepts that certificate through PKINIT and issues a Kerberos ticket-granting ticket for the named account, so the attacker never needs that account's password and never meets its MFA. Will Schroeder and Lee Christensen of SpecterOps catalogued the class as ESC1 to ESC8 in Certified Pre-Owned in June 2021 and Microsoft described two intrusions using ESC1 and ESC8 on October 30, 2026.

How it works

AD CS issues X.509 certificates from templates that define who may enroll, what the certificate may be used for (its extended key usages, or EKUs), and where the subject name comes from. The most common abuse, ESC1, needs all of the following on one template: an enterprise CA that lets low-privileged users request certificates, manager approval disabled, no authorized signatures required, enrollment rights granted to a broad group, an EKU that allows client authentication, and the setting that lets the requester supply the subject alternative name in the request.

A typical ESC1 chain:

  1. Foothold. Any domain user session; in Microsoft's 2026 cases, a fake IT support call on Teams and Quick Assist.
  2. Enumerate. The attacker reads the PKI objects over LDAP, which any authenticated user can do, and finds an ESC1 template.
  3. Request. They submit a certificate request on that template naming a Domain Admin in the subject alternative name. The CA checks that the requester may enroll, which they may, and signs.
  4. Authenticate. The certificate goes to the domain controller through PKINIT, which returns a TGT for the Domain Admin.
  5. Act. DCSync, persistence, data theft, in one 2026 case within seconds of receiving the certificate.

Other paths reach the same outcome. ESC8 relays a coerced NTLM authentication, for example from a domain controller forced to authenticate by PetitPotam, to the CA's HTTP web enrollment endpoint and receives a certificate for the relayed machine. ESC4 is write access on the template itself, which lets an attacker make it ESC1. ESC6 is the CA-wide EDITF_ATTRIBUTESUBJECTALTNAME2 flag, which lets any request carry an arbitrary SAN. CVE-2022-26923 (Certifried) abused how the domain controller mapped a certificate to an account through an attacker-controllable DNS host name on a computer object. CVE-2024-49019 (ESC15, EKUwu) let an Application Policy extension in a request to a schema version 1 template override the EKUs the administrator intended. CVE-2025-26647 was a PKINIT gap in NTAuth checks defenders assumed were enforced.

Why it works

A certificate signed by the enterprise CA and present in NTAuth is treated as strong proof of identity, by design. The control assumption that fails is that every template the CA publishes was reviewed with the rigor of domain security policy. Templates accumulate and keep permissions nobody re-examines. Two further assumptions fail during response. A password reset does not revoke a certificate; SpecterOps noted in 2021 that maliciously enrolled certificates "will still be usable even if the user (or computer) resets their password." And revocation does not reach back: Microsoft's 2026 write-up warns that "revoking a certificate does not retroactively invalidate TGTs or service tickets that were already issued." Certificate abuse lives in the MFA blind zone: the privileged account never performs an interactive login that MFA could guard.

How to detect it

All of the following require the CA's Audit Certification Services subcategory and the CA audit filter to be enabled. Neither is on by default, and without them there is nothing to review after the fact.

  • 4886 and 4887 on the CA. Event 4886 records a received certificate request and 4887 an approved and issued one, with requester and subject fields. The ESC1 tell is a 4887 where the requester and the subject or SAN are different accounts, especially when the subject is privileged.
  • Template and CA changes. 4899 (template updated), 4900 (template security updated), 4882 (CA security permissions changed), and 4885 (audit filter changed) indicate someone turning a template into ESC1 or switching off logging. Microsoft's Securing PKI appendix rates 4882 and 4885 high: one occurrence is worth investigating. A registry audit event 4657 on EditFlags that sets EDITF_ATTRIBUTESUBJECTALTNAME2 is ESC6 being enabled.
  • Mapping events on domain controllers. Since KB5014754, Kdcsvc event 39 logs a certificate with no strong mapping, and event 41 logs a certificate whose SID extension does not match the account it is being used for, which is the certificate-issued-to-someone-else pattern.
  • First-time certificate logon. A 4768 TGT request with Pre-Authentication Type 15 or 16 (smart card or certificate) and the certificate issuer, serial, and thumbprint fields populated, for an account that has never used certificate logon before. Microsoft also suggests alerting when the issuer is not a CA authorized to issue logon certificates.
  • ITDR alerts. Microsoft Defender for Identity raised ESC1, ESC8, PKINIT, and DCSync alerts in the 2026 cases, and its AD CS posture assessments flag vulnerable templates before they are used.

The honest gap: many organizations discover mid-incident that CA auditing was never on, and 4886 and 4887 volume on a busy CA leaves the requester-versus-subject mismatch as the only usable alert.

How to stop it

Ranked by effect:

  1. Remove requester-supplied subjects from authentication templates. Any template with a client authentication EKU and "supply in the request" should be changed to build the subject from Active Directory, or require manager approval. This kills ESC1.
  2. Remove broad enrollment and write rights. Domain Users, Authenticated Users, and Domain Computers should not hold Enroll on privileged-capable templates or any write right on any template (ESC4).
  3. Harden or remove HTTP enrollment. Microsoft recommends removing unneeded Web Enrollment endpoints, requiring HTTPS with Extended Protection for Authentication, and disabling NTLM on enrollment services (KB5005413), which closes ESC8.
  4. Run strong certificate mapping. KB5014754 moved domain controllers to Full Enforcement on February 11, 2025, and the September 9, 2025 update removed the option to return to Compatibility mode. Confirm you are not running an older or exempted configuration.
  5. Patch for Certifried, ESC15 (and inventory schema version 1 templates that allow requester-supplied subjects), and the April 2025 PKINIT fix, then audit the NTAuth store so only intended CAs are in it.
  6. Enable CA auditing and retain it as long as domain controller logs.
  7. Plan certificate-aware response. Revoke unauthorized certificates, publish a fresh CRL, and separately deal with Kerberos tickets already issued from them; reset krbtgt twice if DCSync occurred. Treat AD CS as tier zero. See the identity incident response runbook, PKI, and certificate lifecycle management.

Seen in the wild

Sources

Related identity CVEs and breaches

Last reviewed By SWI Community TeamSuggest a correctionHow we research

In the Identity Breach Database

Real incidents in our sourced breach database where this technique was used.

Browse the full database

Seeing this technique used differently, or have a detection rule that works better? Email community@startwithidentity.com. See all briefs in the technique catalog, or volunteer as a CVE Analyst.
Mapped to MITRE ATT&CK where a technique ID exists. Independent, community-driven analysis, not a substitute for the ATT&CK knowledge base. See the disclaimer.