SKILL: AD CS Attack Playbook, Expert Guide

AI LOAD INSTRUCTION: Expert AD CS (Active Directory Certificate Services) attack techniques. Covers ESC1 through ESC13, certificate-based persistence, NTLM relay to enrollment endpoints, and CA misconfigurations. Base models miss enrollment prerequisite chains and ESC condition combinations.

0. RELATED ROUTING

Before going deep, consider loading:

• active-directory-acl-abuse for ACL-based attacks that enable ESC4 (template modification)
• active-directory-kerberos-attacks for Kerberos techniques after obtaining certificates
• ntlm-relay-coercion for ESC8 (relay to HTTP enrollment endpoint)
• windows-lateral-movement for using obtained certificates for lateral movement

Advanced Reference

Also load ADCS_ESC_MATRIX.md when you need:

• ESC1, ESC13 quick reference table with conditions, impact, and tool commands
• One-liner exploitation commands per ESC variant
• Detection indicators per technique

---

1. AD CS ARCHITECTURE OVERVIEW

Certificate Authority (CA)
│
├── Enterprise CA (AD-integrated, issues certs based on templates)
│   ├── Certificate Templates (define who can enroll, what EKUs, subject settings)
│   ├── Enrollment endpoints: HTTP (certsrv), RPC, DCOM
│   └── Published in AD: CN=Public Key Services,CN=Services,CN=Configuration
│
├── Template Key Settings:
│   ├── Subject Alternative Name (SAN): who the cert represents
│   ├── Extended Key Usage (EKU): what the cert allows
│   ├── Enrollment permissions: who can request
│   └── Issuance requirements: manager approval, authorized signatures
│
└── Certificate → Kerberos Auth Flow:
    User presents cert → PKINIT → KDC verifies → issues TGT

---

2. ENUMERATION