⤷ Title: Detecting ADCS Privilege Escalation
════════════════════════
𐀪 Author: BHIS
════════════════════════
ⴵ Time: Wed, 23 Jul 2025 13:31:22 +0000
════════════════════════
⌗ Tags: #Alyssa Snow #Blue Team #Blue Team Tools #External/Internal #How_To #Informational #Active Directory #ADCS
════════════════════════
𐀪 Author: BHIS
════════════════════════
ⴵ Time: Wed, 23 Jul 2025 13:31:22 +0000
════════════════════════
⌗ Tags: #Alyssa Snow #Blue Team #Blue Team Tools #External/Internal #How_To #Informational #Active Directory #ADCS
Black Hills Information Security, Inc.
Detecting ADCS Privilege Escalation - Black Hills Information Security, Inc.
Active Directory Certificate Services (ADCS) is used to manage certificates for systems, users, applications, and more in an enterprise environment. Misconfigurations in ADCS can introduce critical vulnerabilities into an enterprise Active Directory environment.
⤷ Title: Golden and Silver Ticket Attacks — a practical explainer for defenders
════════════════════════
𐀪 Author: Paritosh
════════════════════════
ⴵ Time: Mon, 29 Sep 2025 02:09:11 GMT
════════════════════════
⌗ Tags: #cybersecurity #information_technology #active_directory #hacking #adcs_attacks
════════════════════════
𐀪 Author: Paritosh
════════════════════════
ⴵ Time: Mon, 29 Sep 2025 02:09:11 GMT
════════════════════════
⌗ Tags: #cybersecurity #information_technology #active_directory #hacking #adcs_attacks
Medium
Golden and Silver Ticket Attacks — a practical explainer for defenders
Golden- and Silver-ticket attacks are Kerberos ticket-forging techniques used by attackers after they’ve already gained a foothold in an…
⤷ Title: ESC1: Client Authentication with ENROLLEE_SUPPLIES_SUBJECT
════════════════════════
𐀪 Author: Maishamanarat
════════════════════════
ⴵ Time: Mon, 27 Oct 2025 12:05:48 GMT
════════════════════════
⌗ Tags: #adcs_attacks #active_directory #privilege_escalation #penetration_testing
════════════════════════
𐀪 Author: Maishamanarat
════════════════════════
ⴵ Time: Mon, 27 Oct 2025 12:05:48 GMT
════════════════════════
⌗ Tags: #adcs_attacks #active_directory #privilege_escalation #penetration_testing
Medium
ESC1: Client Authentication with ENROLLEE_SUPPLIES_SUBJECT
Active Directory Certificate Services (AD CS) is a crucial Windows server role that manages PKI (Public Key Infrastructure) on a network…
⤷ Title: Escalating to Domain Admin via Misconfigured Certificate Templates: A Red Team Case Study (and Why…
════════════════════════
𐀪 Author: Anthony Cihan
════════════════════════
ⴵ Time: Wed, 29 Oct 2025 20:38:01 GMT
════════════════════════
⌗ Tags: #red_team #adcs_attacks #penetration_testing #active_directory #hacking
════════════════════════
𐀪 Author: Anthony Cihan
════════════════════════
ⴵ Time: Wed, 29 Oct 2025 20:38:01 GMT
════════════════════════
⌗ Tags: #red_team #adcs_attacks #penetration_testing #active_directory #hacking
Medium
Escalating to Domain Admin via Misconfigured Certificate Templates: A Red Team Case Study (and Why Enrollment Agent Was the Key)
Active Directory Certificate Services (AD CS) remains a Tier-0 attack surface. Most red teams look for ESC1 (enrollee supplies subject +…
⤷ Title: Red Teaming — Abusing Active Directory Certificate Services (AD CS) to Escalate Privileges: ESC1…
════════════════════════
𐀪 Author: Rakshit Kashyap
════════════════════════
ⴵ Time: Thu, 13 Nov 2025 18:54:05 GMT
════════════════════════
⌗ Tags: #penetration_testing #privilege_escalation #red_teaming #adcs_attacks
════════════════════════
𐀪 Author: Rakshit Kashyap
════════════════════════
ⴵ Time: Thu, 13 Nov 2025 18:54:05 GMT
════════════════════════
⌗ Tags: #penetration_testing #privilege_escalation #red_teaming #adcs_attacks
Medium
Red Teaming — Abusing Active Directory Certificate Services (AD CS) to Escalate Privileges: ESC1…
During an authorized Red Teaming assessment, I discovered that a misconfigured EAP-BYOD certificate template in Active Directory…
⤷ Title: Certified to Pwn: A TL;DR on ADCS Abuse using ESC 1–4 Templates
════════════════════════
𐀪 Author: Akchhat
════════════════════════
ⴵ Time: Mon, 16 Feb 2026 08:06:34 GMT
════════════════════════
⌗ Tags: #adcs_attacks #penetration_testing #ad_pentesting #microsoft #red_teaming
════════════════════════
𐀪 Author: Akchhat
════════════════════════
ⴵ Time: Mon, 16 Feb 2026 08:06:34 GMT
════════════════════════
⌗ Tags: #adcs_attacks #penetration_testing #ad_pentesting #microsoft #red_teaming
Medium
Certified to Pwn: A TL;DR on ADCS Abuse using ESC 1–4 Templates
Hello Amazing Hackers, I hope you all are doing great. This is Akchhat back with another blog. Today We’ll be taking a deeper look into the…
⤷ Title: Coercion to krbtgt: NTLM Relay and ADCS ESC8 in 2026
════════════════════════
𐀪 Author: Gilo
════════════════════════
ⴵ Time: Thu, 23 Jul 2026 15:33:38 GMT
════════════════════════
⌗ Tags: #cybersecurity #penetration_testing #dfir #esc8 #adcs_attacks
════════════════════════
𐀪 Author: Gilo
════════════════════════
ⴵ Time: Thu, 23 Jul 2026 15:33:38 GMT
════════════════════════
⌗ Tags: #cybersecurity #penetration_testing #dfir #esc8 #adcs_attacks
Medium
Coercion to krbtgt: NTLM Relay and ADCS ESC8 in 2026
A lab-verified walkthrough of the coercion to relay to certificate chain, and the forensic method for reconstructing it after the fact.
⤷ Title: Hack Smarter Labs : Arasaka
════════════════════════
𐀪 Author: Andypoon
════════════════════════
ⴵ Time: Sat, 03 Oct 2026 18:53:54 GMT
════════════════════════
⌗ Tags: #adcs_attacks #active_directory #hack_smarter #ethical_hacking
════════════════════════
𐀪 Author: Andypoon
════════════════════════
ⴵ Time: Sat, 03 Oct 2026 18:53:54 GMT
════════════════════════
⌗ Tags: #adcs_attacks #active_directory #hack_smarter #ethical_hacking
Medium
Hack Smarter Labs : Arasaka
Arasaka is another easy rated Active Directory machine on Hack Smarter Labs.