Darhost

Active Directory Certificate Services (AD CS) is a critical component in many enterprise environments, providing public key infrastructure (PKI) capabilities. However, its complexity often leads to security gaps that attackers can exploit. This article delves into advanced misuse techniques targeting AD CS, including template misconfigurations and shadow credential attacks, and offers defenders practical behavioral detection strategies.

Understanding AD CS and Its Attack Surface

AD CS enables organizations to manage digital certificates for authentication, encryption, and signing. Its integration with Active Directory means that a compromise of AD CS can quickly escalate to domain-wide privileges. Attackers focus on two primary vectors: misconfigured certificate templates and the misuse of shadow credentials.

Certificate Template Misconfigurations

Certificate templates define the properties and issuance policies for certificates. Common misconfigurations include:

• Enrollment rights granted to low-privileged users – Allowing any domain user to enroll for sensitive templates.
• Poorly defined key usage extensions – Templates with Client Authentication or Smart Card Logon can be abused for lateral movement.
• Unrestricted subject name specifications – Enabling the requester to specify a privileged account's name in the certificate.

Attackers leverage tools like Certify or PKINITtools to enumerate vulnerable templates and request certificates that impersonate high-value accounts, such as domain administrators.

Shadow Credentials in Depth

Shadow credentials is a technique that exploits the Key Credential Link attribute in Active Directory. By writing a public key to this attribute for a target account (e.g., a domain controller), an attacker can authenticate as that account using Kerberos PKINIT without knowing its password. The attack steps are:

1. Identify an account with the ability to modify its own msDS-KeyCredentialLink attribute (or find an object with weak ACLs).
2. Generate a new key pair and write the public key to the target's attribute.
3. Request a Kerberos TGT using the corresponding private key, effectively gaining domain persistence.

Tools such as Whisker and Impacket simplify this process, making it a favored method for stealthy escalation.

Tools Used by Attackers

Several open-source and commercial tools are commonly employed in AD CS attacks:

• Certify – Enumerates and exploits vulnerable certificate templates.
• Certipy – A Python tool for certificate misconfiguration exploitation and shadow credentials.
• Whisker – Dedicated to shadow credential operations.
• Rubeus – For Kerberos ticket manipulation after certificate acquisition.

Defenders must monitor for execution patterns of these tools, such as unusual LDAP queries or certificate enrollment requests.

Behavioral Detection Strategies for Defenders

Detecting AD CS abuse requires monitoring both authentication logs and certificate services events. Key indicators include:

• Event ID 4886 (Certificate Services approved a certificate request) combined with an unusual requester (e.g., a low-privileged user).
• Event ID 4768 (Kerberos TGT requested) with Certificate Information containing suspicious certificate hashes.
• Sudden changes to the msDS-KeyCredentialLink attribute – monitor with Azure ATP or custom SIEM rules.

For a deeper dive into detection, review the tools section to understand what attacker behavior looks like.

Hardening Recommendations

Prevention is equally important. Consider these steps:

• Review all certificate templates and restrict enrollment rights to authorized personnel.
• Enable CA Auditing and log all certificate requests.
• Disable the Key Credential Link attribute if not needed – or monitor it closely.
• Use Protected Users group and enable PKINIT only for required accounts.

Conclusion

AD CS escalation remains a potent attack vector due to its deep integration and frequent misconfigurations. By understanding techniques like template abuse and shadow credentials, and implementing behavioral detection, defenders can significantly reduce risk. The key is to combine preventative hardening with proactive monitoring, ensuring that even if attackers gain a foothold, their movements are visible.

Originally analyzed by Unit 42 at Palo Alto Networks, this article expands on their findings to provide actionable guidance for security teams.