ADCS ESC1 Privilege Escalation: CISA AA26-237A Red Team Findings and CA Database Hunting Methodology

ADCS ESC1 Privilege Escalation (TL-2026-2168), also tracked as ESC1, is a high-severity software vulnerability, first published 2026-08-27. It has no confirmed attribution, affects Microsoft Active Directory Certificate Services (AD CS), maps to 14 MITRE ATT&CK techniques (T1003, T1018, T1078), and is covered by 9 detection rules and 14 indicators of compromise.

Key facts for TL-2026-2168

Threat ID
TL-2026-2168
Also known as
ESC1, AD CS ESC1, Certighost
Severity
HIGH
Status
ACTIVE
Category
VULNERABILITY
First published
2026-08-27
Last reviewed
2026-08-27
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government services and facilities, water and wastewater systems, critical infrastructure
Target regions
united states of america
Detection rules
9
Indicators of compromise
14

Malware and tooling in ADCS ESC1 Privilege Escalation

Malware and tooling: ADConnectDump, Certipy, Velociraptor, certreq

CISA advisory AA26-237A documents red teams exploiting the AD CS ESC1 certificate-template misconfiguration (CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT + low-privileged enrollment) to escalate from a Machine-Account-Quota-created machine account to arbitrary user/computer impersonation at two critical infrastructure organizations. GuidePoint Security's companion research shows how to hunt this abuse by forensically parsing the CA's ESE database (Windows\System32\CertLog) with Velociraptor, including a fix for a go-ese FILETIME/OLE-double timestamp bug.

How ADCS ESC1 Privilege Escalation works

On 2026-08-25 CISA published AA26-237A, "A Tale of Two SOCs: Insights From Two Red Team Assessments," comparing simultaneous red team engagements against a Government Services and Facilities Sector organization ("Organization A") and a Water and Wastewater Systems Sector organization ("Organization B"). Both red teams used comparable tradecraft and fully compromised the Active Directory domain, sensitive business systems, and cloud resources at each target, but the organizations' detection outcomes diverged sharply: Organization A's SOC never detected the intrusion, while Organization B's SOC isolated the initial workstation compromise within 2-20 minutes and forced the red team into an assume-breach posture for the rest of the assessment.

The central privilege-escalation chain in both engagements combined two Active Directory weaknesses. First, a permissive or default Machine Account Quota (ms-DS-MachineAccountQuota, 10 at Organization A and 1,000 at Organization B) let any authenticated domain user create new machine/computer accounts. Second, both environments contained AD CS certificate templates misconfigured with the ESC1 pattern -- CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT enabled alongside overly broad, low-privileged enrollment rights -- letting the requester supply an arbitrary certificate subject/SAN. By enrolling the MAQ-created machine account against the vulnerable template and supplying a privileged user's or domain controller's identity as the subject, the red teams obtained certificates that authenticated as that identity, achieving domain-level privilege escalation. CISA notes this is the same misconfiguration class behind the recently disclosed domain-takeover exploit chain nicknamed "Certighost," and cites SpecterOps' "Certified Pre-Owned" research as the foundational description of ESC1.

From that foothold, both teams harvested cleartext credentials left in accessible configuration files -- SQL Developer's connections.json and product-preferences.xml at Organization A, and a domain service-account password embedded in an SCCM XML file at Organization B -- and used DCSync to pull AD account secrets including the krbtgt hash, enabling Kerberos ticket forgery and impersonation. Organization A's team additionally found long-lived, non-expiring static AWS IAM access keys in user home directories and abused Resource-Based Constrained Delegation (via AllExtendedRights permissions) for further privilege escalation, then pivoted to Microsoft Entra ID/cloud by stealing Primary Refresh Tokens and abusing over-permissioned Entra ID applications (Graph API scopes including Mail.Read, Mail.ReadWrite, Chat.Read.All, Files.Read.All, Application.ReadWrite.All, and AppRoleAssignment.ReadWrite.All) -- including reading the security team's own communications to gauge detection status. Organization B's team used ADConnectDump to extract MSOL/Entra Connect sync credentials and abused Seamless SSO (the AZUREADSSOACC computer account's Kerberos tickets) for cloud impersonation, but was blocked from pivoting into the OT DMZ bastion host by outbound network filtering that prevented C2 callback.

CISA attributes the detection gap at Organization A to organizational rather than tooling failures: siloed SOCs and EDR tooling without centralized visibility, thousands of false-positive alerts masking real signal, limited analyst escalation authority, and a dismissed SCCM alert whose system owner could not be identified. Organization B's rapid containment reflected the opposite: clear escalation paths and tuned alerting.

GuidePoint Security's companion blog (published 2026-08-27) provides the defender-side hunting methodology for the ESC1 abuse step of this chain: rather than relying on live CA auditing (which attackers can suppress or which may not be enabled), GuidePoint parses the CA server's underlying Extensible Storage Engine (ESE) database at Windows\System32\CertLog directly, using custom Velociraptor VQL artifacts to extract the Requests, Certificates, and RequestAttributes tables without touching the live CA service. RequestAttributes exposes the template name and attacker-supplied SAN/UPN values that are the clearest signal of ESC1 abuse -- a certificate requested by a low-privileged or newly created account, against an ESC1-flagged template, carrying a SAN for a privileged identity. During this work GuidePoint identified and fixed a bug in the underlying go-ese Go library: FILETIME byte sequences were being misinterpreted as OLE Automation doubles, causing every DateTime column in the ESE database to resolve to 1899-12-30T00:00:00Z. The fix uses value-range inspection to select the correct decoder per field and shipped in Velociraptor 0.76.6+, restoring accurate timestamps for the certificate-request timeline needed to reconstruct an ESC1 attack.

MITRE ATT&CK techniques used in TL-2026-2168

Credential Access

T1003 OS Credential Dumping; T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1558 Steal or Forge Kerberos Tickets; T1649 Steal or Forge Authentication Certificates

Discovery

T1018 Remote System Discovery

Initial Access

T1078 Valid Accounts; T1566 Phishing

Privilege Escalation

T1078 Valid Accounts; T1098 Account Manipulation

Defense Evasion

T1078 Valid Accounts

Collection

T1114 Email Collection

Persistence

T1136 Create Account

Lateral Movement

T1534 Internal Spearphishing; T1550 Use Alternate Authentication Material

Reconnaissance

T1589 Gather Victim Identity Information

Affected products and versions in ADCS ESC1 Privilege Escalation

  • Microsoft — Active Directory Certificate Services (AD CS)
    Vulnerable versions: Any AD CS deployment with a certificate template that has CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT enabled combined with low-privileged enrollment rights (the ESC1 misconfiguration), regardless of Windows Server version
    Fixed in: Templates reconfigured to disable ENROLLEE_SUPPLIES_SUBJECT, restrict enrollment to appropriate principals, and require manager approval
  • Velociraptor (open-source, Rapid7-sponsored) — go-ese ESE database parsing library (used by Velociraptor's CertLog/ESE artifacts)
    Vulnerable versions: Versions prior to 0.76.6, where FILETIME byte sequences were misdecoded as OLE Automation doubles, resolving all DateTime fields to 1899-12-30T00:00:00Z
    Fixed in: 0.76.6 and later, which added value-range inspection to select the correct FILETIME vs. OLE-double decoder

Remediation for ADCS ESC1 Privilege Escalation

Patches

  • Upgrade Velociraptor to 0.76.6 or later to pick up the corrected go-ese FILETIME/OLE-double timestamp decoder

Immediate actions

  • Set the Machine Account Quota (ms-DS-MachineAccountQuota) to 0 domain-wide unless a specific, documented operational need requires otherwise
  • Inventory all AD CS certificate templates for CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT enabled combined with low-privileged/broad enrollment rights (the ESC1 pattern) and remediate or disable them immediately
  • Hunt the CA server's Windows\System32\CertLog ESE database with Velociraptor 0.76.6+ (or later) for certificate requests where the RequestAttributes SAN/UPN identity does not match the low-privileged requester

Workarounds

  • Manually audit AD CS templates for ENROLLEE_SUPPLIES_SUBJECT plus broad enrollment permissions using certutil or PSPKI while template hardening is scheduled
  • Restrict or remove cleartext credential storage in developer tool configuration files (e.g. SQL Developer connections.json/product-preferences.xml) and SCCM configuration exports pending centralized secrets management

Longer-term hardening

  • Require certificate manager approval and restrict autoenrollment on sensitive/impersonation-capable templates
  • Move long-lived static cloud credentials (e.g. AWS IAM access keys) to temporary, SSO-issued credentials with enforced expiration
  • Establish automated Primary Refresh Token / OAuth refresh-token revocation procedures and Conditional Access policies for workload identities
  • Audit and reduce Graph API application permissions (Mail.Read, Mail.ReadWrite, Files.Read.All, Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All) to least privilege
  • Centralize SOC visibility across all EDR/SIEM tooling, define clear analyst escalation authority, and tune alerting to reduce false-positive volume that can mask real intrusions
  • Segment IT/OT networks and enforce strict egress filtering from OT DMZ bastion hosts

Weaknesses (CWE) in ADCS ESC1 Privilege Escalation

CWE-284

Timeline of ADCS ESC1 Privilege Escalation

  • Organization B: red team reaches the OT DMZ bastion host but is blocked from establishing command-and-control into the OT network by outbound egress filtering.
  • Organization B: red team continues under an assume-breach model, finds a cleartext SCCM service-account password, and runs DCSync to obtain the krbtgt secret.
  • Organization B: red team spearphishes users with malicious links; SOC detects and quarantines the initial compromise within 2-20 minutes.
  • Organization A: red team steals Primary Refresh Tokens and abuses over-permissioned Entra ID applications to read security-team email and pivot into cloud resources, undetected throughout.
  • Organization A: red team harvests cleartext credentials from SQL Developer config files and long-lived static AWS IAM keys, reaching three sensitive business systems undetected.
  • Organization A: red team identifies an AD CS template with CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT enabled (ESC1) and requests certificates impersonating privileged user and computer accounts.
  • Organization A: red team abuses the default Machine Account Quota (10) to create a controlled machine account.
  • Organization A: red team gains initial access via default credentials in a public-facing web application, then uses internal email to send phishing messages, compromising four workstations.
  • CISA publishes AA26-237A, "A Tale of Two SOCs," detailing two simultaneous red team assessments against critical infrastructure organizations.
  • GuidePoint Security identifies and fixes a go-ese library bug that misdecoded FILETIME values as OLE doubles, shipped in Velociraptor 0.76.6+.
  • GuidePoint Security publishes a blog detailing how to hunt ESC1 abuse by forensically parsing the CA server's ESE database (Windows\System32\CertLog) with Velociraptor.

Sources cited for ADCS ESC1 Privilege Escalation

More in vulnerability

Detection coverage for TL-2026-2168

As of 2026-08-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2168 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats