Vulnerabilities AD CS: How Attackers Exploit Certification Services for Privilege Escalation

Attacks on Active Directory Certificate Services: An Underestimated Privilege Escalation Vector

Active Directory Certificate Services (AD CS) is a fundamental component of the Windows enterprise infrastructure, responsible for managing the public key infrastructure (PKI) and issuing certificates that enable authentication and encryption in networks. Despite its critical role in the enterprise identity infrastructure, AD CS is often weakened by insecure default configurations and design complexity, resulting in exploitable attack surfaces. Due to unconfigured certificate templates and overly permissive enrollment rights, AD CS has emerged as a high-impact, under-monitored vector for privilege escalation and unauthorized identity impersonation in modern environments.

Unlike traditional vulnerability exploitation, attacks on AD CS rarely rely on zero-day vulnerabilities or malware. Instead, adversaries abuse the native certificate issuance system to impersonate privileged accounts, escalate privileges, and establish persistence. Observations from Unit 42 and industry reports show that these weaknesses are actively exploited by both profit-driven ransomware groups and state-sponsored actors.

In this in-depth technical analysis, we examine the advanced exploitation of AD CS, including unconfigured certificate templates and the abuse of shadow credentials. Our findings present a comprehensive overview of the attackers' toolkit and their evolving operational behaviors.

Studying behavioral analysis, correlating event logs, and linking offensive techniques to actionable telemetry enables the creation of dynamic and comprehensive detection strategies. Our detection methods reveal patterns and methods that go beyond traditional signature-based approaches. We aim to provide defenders with unique ways to uncover the stealthy abuse of AD CS and bridge a persistent gap in enterprise security.

AD CS Overview

AD CS is the backbone of enterprise PKI. At its core is the Certification Authority (CA), the service responsible for issuing and managing digital certificates. These certificates are cryptographic IDs that prove a user, device, or service is what it claims to be. Organizations rely on AD CS for:

• User authentication: Certificates enable single sign-on and client authentication in services
• Service authentication: Internal services and domain controllers validate identity using PKI
• Encryption: Certificates support secure communications within and outside the enterprise

The same capabilities that make AD CS indispensable also create risks. To manage certificate issuance, AD CS uses certificate templates, which define who can request certificates, what they can be used for, and the permissions required. When not configured correctly, these templates can grant long-term authentication access or privileges, effectively providing complete control over a network.

Certificate issuance is an expected administrative function that often appears as normal network activity. This makes AD CS a powerful tool for adversaries, as exploitation frequently evades detection.

Phases of the AD CS Exploitation Lifecycle

The lifecycle of AD CS exploitation typically comprises five phases:

1. Initial Access: Compromise of low-privilege accounts via phishing, credential theft, or other vectors
2. Discovery: Enumeration of CA servers, certificate templates, enrollment permissions, and account keys
3. Exploitation: Abuse of unconfigured templates to request certificates or register cryptographic keys for privileged accounts
4. Privilege Escalation and Lateral Movement: Use of certificates or keys with public key cryptography for initial authentication (PKINIT) to request Kerberos tickets and impersonate privileged users
5. Persistence: Maintaining access via shadow credentials, key trust abuse, and certificate renewal

Common Attack Techniques

The key adversary tactics, techniques, and procedures (TTPs) targeting AD CS include:

• Unconfigured Certificate Templates: Define how AD CS issues certificates, including who can request them and what privileges they grant. Common templates include:
  • Low-privilege users allowed to enroll in high-privilege templates
  • Dangerous template flags enabled, such as the "Supply in the request" option that allows the requesting user to define the certificate subject in the certificate signing request (CSR)

In August 2024, Rapid7 described a social engineering campaign in which attackers attempted to escalate privileges by exploiting CVE-2022-26923. This vulnerability allows a low-privilege user to elevate their privileges by acquiring a certificate from AD CS. The attackers attempted to do this by tricking users into running a malicious script named "update.bat" that was delivered via phishing.

The Role of the Security Community

Addressing the threat posed by AD CS requires a collective effort from the cybersecurity community. Information sharing and collaboration between organizations, security solution providers, and independent researchers are crucial for developing effective defense strategies.

Initiatives such as those promoted by Palo Alto Networks, which include threat intelligence sharing and the creation of advanced detection tools, are playing a key role in strengthening enterprise defenses against AD CS exploitation attacks.

Conclusions and Future Perspectives

The future of AD CS security will depend on organizations' ability to adapt to evolving threats. With the increasing complexity of attacks and the growing sophistication of adversaries, it will be essential to invest in advanced technologies, specialized skills, and robust risk management practices.

Organizations that adopt an integrated approach to security, combining advanced technological solutions with appropriate management practices, will be better prepared to face the challenges posed by AD CS exploitation attacks. Continuous collaboration and knowledge sharing within the security community remain fundamental to ensuring a safer digital environment for all.

For more information on how to protect your organization from AD CS exploitation attacks, visit the Palo Alto Networks website or contact the Unit 42 Incident Response team.