AD CS ESC1: Certificate Template Abuse to Domain Admin
An ordinary user becomes a Domain Admin without stealing a password. A misconfigured certificate template lets the enrollee supply the subject, so the user requests a certificate whose Subject Alternative Name names a Domain Admin, and the CA issues it. The forged certificate is then used for PKINIT to authenticate as that admin. Work the certificate-authority records, the endpoint process tree, and the domain controller's Kerberos logs to reconstruct the escalation.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Find the foothold
50An energy company's certificate authority issued something this morning that has the identity team worried. Before touching the CA records, work the endpoint telemetry and find where the activity originated. Identify the workstation that ran the certificate tooling.
Identify who was impersonated
60The certificate that was issued does not belong to the person who asked for it. Work the certificate-authority records and determine whose identity the issued certificate actually carries.
Tie the request together
55The request and the issuance are two records, and the privileged logon that followed is a third. One identifier links them. Find the value that ties the certificate request to its issuance.
Follow the certificate to the ticket
55Minutes after the certificate was issued, the impersonated admin authenticated to the domain controller, by certificate, not by password. Confirm the connection and report the internal address the privileged logon came from.
Classify the credential-access technique
50Summarize the escalation for the incident report. No password was phished and no ticket was cracked, the adversary obtained a usable authentication certificate for an account they did not control. Map that to its MITRE ATT&CK technique.
5 tasks · 270 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.