AD-ADCS-001: ESC1: enrollee-supplied subject on an authentication template¶

high   Certificate services   MITRE ATT&CK T1649   Reads: LDAP

A published certificate template lets broad groups supply the subject of an authentication certificate, so any user can enroll as a domain admin.

Also known as: esc1

Why it matters¶

When a template has Supply in the request turned on, the requester writes the subject and subject alternative name (SAN) of the certificate. If the template is also valid for client authentication, the CA issues a certificate that Kerberos (PKINIT) and Schannel accept as proof of identity for whoever is named in the SAN. A member of Domain Users can therefore request a certificate for administrator@corp.example and log on as that account.

The certificate stays valid until it expires or is revoked, even after the template is fixed and the victim's password is changed, which makes ESC1 a persistence technique as well. Strong certificate mapping (KB5014754) does not stop it: the requester can also place the target's SID in the request.

How ad-doctor detects it¶

ad-doctor reads every certificate template and the enterprise CAs (pKIEnrollmentService objects) over LDAP and reports a template when all of these hold:

Each reported object names the template and the broad groups that can enroll, for example LabESC1 (enroll: Domain Users).

Severity¶

Always high: a single certificate request is enough to authenticate as any account.

False positives and limits¶

• Templates enrollable only by a narrower group (for example a "Web Admins" group) are not reported by this check, even though members of that group can still abuse them. Review such templates by hand or with a dedicated AD CS tool.
• CA-side controls that LDAP cannot see, such as a policy module that rewrites the subject or a CA that has the template's requests set to pending in its own configuration, are not taken into account.

Fix¶

Apply at least one of these, in order of preference:

1. Build the subject from Active Directory. In certtmpl.msc, open the template, Subject Name tab, select Build from this Active Directory information. Templates that really need a requester-supplied subject (web server certificates, for example) should not carry an authentication EKU.

2. Restrict enrollment to the group that needs the template. In the template's Security tab, remove Enroll and Autoenroll from Domain Users, Domain Computers, Authenticated Users and Everyone.

3. Require CA manager approval (sets CT_FLAG_PEND_ALL_REQUESTS):

   $cfg = (Get-ADRootDSE).configurationNamingContext
   $dn  = "CN=LabESC1,CN=Certificate Templates,CN=Public Key Services,CN=Services,$cfg"
   $t   = Get-ADObject $dn -Properties 'msPKI-Enrollment-Flag'
   Set-ADObject $dn -Replace @{'msPKI-Enrollment-Flag' = ($t.'msPKI-Enrollment-Flag' -bor 2)} -WhatIf
   

4. Stop publishing a template nobody needs (run on the CA):

   Remove-CATemplate -Name LabESC1 -WhatIf
   

Then look for abuse: in the CA console, Issued Certificates, compare the requester with the subject for certificates from this template, and revoke any that were issued to someone other than the requester (certutil -revoke <serial> 1).

Verify¶

ad-doctor scan dc01.corp.example --ldaps -u 'CORP\auditor' --only AD-ADCS-001

To accept the risk instead, add an entry to the file passed with --accept (see accepted risks):

[[accept]]
check = "AD-ADCS-001"
objects = ["..."]        # optional; without it the whole check is accepted
reason = "..."
expires = 2027-03-31

Related checks¶

• AD-ADCS-002
• AD-ADCS-004
• AD-ADCS-008
• AD-PATH-001

References¶

Microsoft and vendors

• Defender for Identity: Prevent users to request a certificate valid for arbitrary users (ESC1)
• KB5014754: Certificate-based authentication changes on Windows domain controllers
• Remove-CATemplate

Specifications

• [MS-CRTD] msPKI-Certificate-Name-Flag attribute
• [MS-CRTD] msPKI-Enrollment-Flag attribute

Research

• Certified Pre-Owned: Abusing Active Directory Certificate Services (whitepaper, ESC1)
• Certified Pre-Owned (SpecterOps blog)

Tools

• Certipy wiki: Privilege escalation (ESC1)
• Locksmith: find and fix AD CS misconfigurations

MITRE ATT&CK

• T1649

Available since 0.1.0.