AD CS Active Exploitation and Certificate-Based Privilege Escalation Response
When an active ESC attack is confirmed or an unauthorized certificate has been issued: revoke the unauthorized certificate, harden the source, and trigger the krbtgt reset playbook if domain compromise is present.
Prepare
9 steps- CA Audit Log
Activate Certification Services auditing on the CA: `auditpol /set /subcategory:"Certification Services" /success:enable /failure:enable`
- Template and CA Change Log
Enable template change events: `certutil -setreg CA\AuditFilter +128` then `net stop certsvc && net start certsvc`
- DC AD Change Log
"DS Access > Audit Directory Service Changes" must be enabled on all DCs; Event 5136 (UPN, altSecurityIdentities, mail changes) must be forwarded to the SIEM.
- SIEM Correlation Rules
5136 (UPN/altSecId change) → 4887 (certificate) → 4768 (PKINIT) chain correlation; 4886/4887 DC machine account request rules; DR-ADCS-1..11 must be deployed and tuned.
- Strong Certificate Mapping
Verify `StrongCertificateBindingEnforcement = 2` on all DCs: `reg query "HKLM\SYSTEM\CurrentControlSet\Services\Kdc" /v StrongCertificateBindingEnforcement`
- CA Flag Check
Periodically confirm that `EDITF_ATTRIBUTESUBJECTALTNAME2` is absent via `certutil -getreg policy\EditFlags` and that `IF_ENFORCEENCRYPTICERTREQUEST` is enabled via `certutil -getreg CA\InterfaceFlags`.