ESC3 in Active Directory Certificate Services

ESC3 is an Active Directory Certificate Services exposure involving certificate templates that issue Certificate Request Agent certificates. These certificates allow an authorized person or service to submit certificate requests on behalf of another user. This capability has legitimate uses. Organizations may use enrollment agents for smart card deployments, identity registration workflows, Windows Hello for Business, […]

ESC3 in Active Directory Certificate Services Read Post »

Shadow Credentials in Active Directory

Shadow Credentials is a common name for an Active Directory attack path involving unauthorized key credential material on a user or computer object. Shadow Credentials exists when an attacker can add a key credential to an Active Directory object and later use that credential to authenticate as that object. This matters because the attacker may

Shadow Credentials in Active Directory Read Post »

ESC1 in Active Directory Certificate Services

ESC1 is an Active Directory Certificate Services misconfiguration involving certificate templates. ESC1 exists when a user or computer can request an authentication-capable certificate while supplying identity information that should not be under their control. This matters because certificates can act like credentials. If a certificate can be used for authentication, and a requester can influence

ESC1 in Active Directory Certificate Services Read Post »

Certificate Templates in Active Directory Certificate Services

Certificate templates are one of the most important security components in Active Directory Certificate Services. The simplest way to think about a certificate template is: A certificate template defines what kind of certificate can be issued, who can request it, and what the certificate can be used for. Templates are useful because they make certificate

Certificate Templates in Active Directory Certificate Services Read Post »

What is Active Directory Certificate Services

Active Directory Certificate Services, often shortened to AD CS or ADCS, is Microsoft’s public key infrastructure platform for issuing and managing certificates in Windows environments. The simplest way to think about AD CS is that AD CS allows an organization to issue trusted internal certificates for users, computers, services, devices, and applications. Those certificates may

What is Active Directory Certificate Services Read Post »

LDAP Channel Binding and Why It Matters

LDAP channel binding is a security control that helps protect LDAPS authentication by binding the authentication attempt to the TLS channel being used. It is designed to reduce certain relay and man-in-the-middle attack scenarios where an attacker attempts to forward authentication from one connection to another. The simplest way to think about LDAP channel binding

LDAP Channel Binding and Why It Matters Read Post »

NTLM Relay in Active Directory

NTLM relay is an attack technique where an attacker captures NTLM authentication from one system and relays it to another service. Instead of cracking a password or directly stealing plaintext credentials, the attacker abuses the authentication exchange itself. The simplest way to think about NTLM relay is: an attacker convinces one system to authenticate, then

NTLM Relay in Active Directory Read Post »

Scroll to Top