Unit 42 Deep Dive: Advanced AD CS Exploitation — Certificate Template Misuse (ESC1) and Shadow Credentials via msDS-KeyCredentialLink (CVE-2022-26923, Fog Ransomware, Fighting Ursa) — Threadlinqs Intelligence
As of 2026-05-30, Unit 42 Deep Dive: Advanced AD CS Exploitation — Certificate Template Misuse (ESC1) and Shadow Credentials via msDS-KeyCredentialLink (CVE-2022-26923, Fog Ransomware, Fighting Ursa) is a high-severity vulnerability threat attributed to APT28 (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 22 indicators of compromise.
Threat ID: TL-2026-0497 · Severity: HIGH · CVSS: 8.8 · Status: ACTIVE · Category: VULNERABILITY
Attribution: APT28 · Russia · ESPIONAGE
Unit 42 (Palo Alto Networks) published a comprehensive technical deep-dive cataloguing Active Directory Certificate Services (AD CS) abuse techniques including ESC1 certificate template
Unit 42's May 2026 publication consolidates four years of AD CS attack research into a single operational reference for defenders, documenting how attackers exploit certificate-based authentication to achieve domain dominance. The article focuses on two primary attack classes — Certificate Template Misconfigurations (the SpecterOps ESC1–ESC16 taxonomy from Schroeder and Christensen's 2021 'Certified Pre-Owned' whitepaper) and Shadow Credentials / Key Trust abuse — and confirms both vectors are in active use by financially-motivated ransomware crews and state-sponsored intrusion sets.
ESC1 (the canonical certificate template misconfiguration) requires a template that (a) permits client authentication EKUs, (b) allows the requester to supply the Subject Alternative Name (msPKI-Certificate-Name-Flag = ENROLLEE_SUPPLIES_SUBJECT / CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT 0x1), (c) does not require manager approval, and (d) is published on an Enterprise CA with broad enrollment rights. An attacker with enrollment rights requests a certificate while setting the SAN to a high-privilege UPN (e.g. Domain Admin or krbtgt), then uses PKINITtools / Rubeus to perform PKINIT authentication with the resulting certificate, receiving a TGT as the impersonated principal. Certify (.NET) and Certipy (Python) are the de facto offensive tooling — Certipy 4.x supports ESC1 through ESC16 enumeration and exploitation in a single binary.
Shadow Credentials abuse the msDS-KeyCredentialLink attribute introduced for Windows Hello for Business Key Trust. Any principal with GenericWrite or GenericAll over a target object (user or computer) can write a self-generated public key into the target's msDS-KeyCredentialLink, then authenticate as that target via PKINIT — effectively persistent credential theft without a password reset and without triggering DCSync. The Whisker (.NET) and pyWhisker tools automate the attack chain.
CVE-2022-26923 ('Certifried', disclosed by Oliver Lyak / IFsec Labs and patched May 2022) is the underlying domain controller validation flaw that elevated these primitives to full domain compromise. Prior to KB5014754, certificate-based authentication mapped UPN/dNSHostName from the certificate to an AD object without strong binding — an authenticated user who controlled a computer account (default MachineAccountQuota = 10 in most domains) could set its dNSHostName to that of a domain controller, request a certificate via the default Machine template, and authenticate as the DC. The fix introduced strong certificate mapping via the SID security extension (szOID_NTDS_CA_SECURITY_EXT) and Full Enforcement Mode enabled by default in February 2025 (KB5014754 timeline).
Active exploitation has been documented across the threat landscape. The DFIR Report's Fog ransomware case studies (2024–2025) detail post-compromise tradecraft where affiliates pivot from initial access (often SonicWall SSL VPN CVE-2024-40766 or Veeam CVE-2024-40711) into Certipy enumeration, identify a vulnerable ESC1 template, mint a certificate as Domain Admin, perform DCSync, and deploy Fog ransomware. Rapid7's August 2024 IR engagement (referenced by Unit 42) documented a social-engineering campaign delivering update6.exe — a wrapper that attempted CVE-2022-26923 exploitation against unpatched domains. Palo Alto attributes parallel AD CS abuse to Fighting Ursa (overlapping with Microsoft's Forest Blizzard and CrowdStrike's Fancy Bear — GRU Unit 26165 / APT28), targeting government, defense, and energy verticals in Europe and North America.
Detection is constrained because the underlying Windows events (4768 TGT request, 4886 certificate issuance, 4887 CA certificate request approved) are high-volume and lack native correlation with anomalous SANs or KeyCredentialLink modifications. Defenders should baseline 4886/4887 by template, alert on issuance of certificates with mismatched SAN UPNs, monitor msDS-KeyCredentialLink writes (4662 with the appropriate property GUID 5b47d60f-6090
Weaknesses (CWE)
CWE-295, CWE-287, CWE-269
Target sectors: government, defense, energy, financial, healthcare, manufacturing, technology, managed_service_providers, education
Target regions: North America, Europe, United Kingdom, Ukraine, NATO Member States
Detections & IOCs
As of 2026-07-26, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 22 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2022-26923, T1078, T1190, T1059, T1098, T1136, T1068, T1078, T1550, T1553, T1649