AD CS ESC1: Certificate Template Abuse to Domain Admin
An ordinary user becomes a Domain Admin without stealing a password. A misconfigured certificate template lets the enrollee supply the subject, so the user requests a certificate whose Subject Alternative Name names a Domain Admin, and the CA issues it. The forged certificate is then used for PKINIT to authenticate as that admin. Work the certificate-authority records, the endpoint process tree, and the domain controller's Kerberos logs to reconstruct the escalation.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Find the foothold
50An energy company's certificate authority issued something this morning that has the identity team worried. Before touching the CA records, work the endpoint telemetry and find where the activity originated. Identify the workstation that ran the certificate tooling.
Identify who was impersonated
60The certificate that was issued does not belong to the person who asked for it. Work the certificate-authority records and determine whose identity the issued certificate actually carries.
Tie the request together
55The request and the issuance are two records, and the privileged logon that followed is a third. One identifier links them. Find the value that ties the certificate request to its issuance.
Follow the certificate to the ticket
55Minutes after the certificate was issued, the impersonated admin authenticated to the domain controller, by certificate, not by password. Confirm the connection and report the internal address the privileged logon came from.
Classify the credential-access technique
50Summarize the escalation for the incident report. No password was phished and no ticket was cracked, the adversary obtained a usable authentication certificate for an account they did not control. Map that to its MITRE ATT&CK technique.
5 tasks · 270 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
Ready to investigate?
More Operations
View allPhishing foothold → domain compromise
A finance user at Vendt Aerospace opened a mail attachment mid-morning, and within the hour an administrative account was signing in to a server it had no business reaching. Work the domain controller's authentication records and the endpoint process telemetry, separate the intrusion from an estate that produces plenty of traffic that looks similar, and reconstruct how the operator got from one workstation to the directory.
Ivanti Connect Secure: Auth Bypass to Webshell
An internet-facing Ivanti Connect Secure VPN appliance has been exploited through a pair of chained zero-days: an authentication bypass and a command injection. A webshell is now resident on the appliance, credentials have been stolen from the system configuration, and the attacker has pivoted inward. Work from the SIEM access logs, the Linux host audit trail, and the XDR process tree to reconstruct the chain from the first bypass request to the internal pivot.
Cleo Harmony MFT: Cl0p Data Theft at Vantex Logistics
A Cleo Harmony managed file transfer server in the Vantex Logistics DMZ started reaching external systems it does not normally contact and running processes the change record does not explain. Reconstruct what happened from the Cleo web logs, the Windows event logs, the resolver and the perimeter firewall.