ADCS ESC1 Privilege Escalation: CISA AA26-237A Red Team Findings and CA Database Hunting Methodology — Threadlinqs Intelligence
As of 2026-08-27, ADCS ESC1 Privilege Escalation: CISA AA26-237A Red Team Findings and CA Database Hunting Methodology is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 14 indicators of compromise.
Threat ID: TL-2026-2168 · Severity: HIGH · Status: ACTIVE · Category: VULNERABILITY
CISA advisory AA26-237A documents red teams exploiting the AD CS ESC1 certificate-template misconfiguration (CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT + low-privileged enrollment) to escalate from a
On 2026-08-25 CISA published AA26-237A, "A Tale of Two SOCs: Insights From Two Red Team Assessments," comparing simultaneous red team engagements against a Government Services and Facilities Sector organization ("Organization A") and a Water and Wastewater Systems Sector organization ("Organization B"). Both red teams used comparable tradecraft and fully compromised the Active Directory domain, sensitive business systems, and cloud resources at each target, but the organizations' detection outcomes diverged sharply: Organization A's SOC never detected the intrusion, while Organization B's SOC isolated the initial workstation compromise within 2-20 minutes and forced the red team into an assume-breach posture for the rest of the assessment.
The central privilege-escalation chain in both engagements combined two Active Directory weaknesses. First, a permissive or default Machine Account Quota (ms-DS-MachineAccountQuota, 10 at Organization A and 1,000 at Organization B) let any authenticated domain user create new machine/computer accounts. Second, both environments contained AD CS certificate templates misconfigured with the ESC1 pattern -- CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT enabled alongside overly broad, low-privileged enrollment rights -- letting the requester supply an arbitrary certificate subject/SAN. By enrolling the MAQ-created machine account against the vulnerable template and supplying a privileged user's or domain controller's identity as the subject, the red teams obtained certificates that authenticated as that identity, achieving domain-level privilege escalation. CISA notes this is the same misconfiguration class behind the recently disclosed domain-takeover exploit chain nicknamed "Certighost," and cites SpecterOps' "Certified Pre-Owned" research as the foundational description of ESC1.
From that foothold, both teams harvested cleartext credentials left in accessible configuration files -- SQL Developer's connections.json and product-preferences.xml at Organization A, and a domain service-account password embedded in an SCCM XML file at Organization B -- and used DCSync to pull AD account secrets including the krbtgt hash, enabling Kerberos ticket forgery and impersonation. Organization A's team additionally found long-lived, non-expiring static AWS IAM access keys in user home directories and abused Resource-Based Constrained Delegation (via AllExtendedRights permissions) for further privilege escalation, then pivoted to Microsoft Entra ID/cloud by stealing Primary Refresh Tokens and abusing over-permissioned Entra ID applications (Graph API scopes including Mail.Read, Mail.ReadWrite, Chat.Read.All, Files.Read.All, Application.ReadWrite.All, and AppRoleAssignment.ReadWrite.All) -- including reading the security team's own communications to gauge detection status. Organization B's team used ADConnectDump to extract MSOL/Entra Connect sync credentials and abused Seamless SSO (the AZUREADSSOACC computer account's Kerberos tickets) for cloud impersonation, but was blocked from pivoting into the OT DMZ bastion host by outbound network filtering that prevented C2 callback.
CISA attributes the detection gap at Organization A to organizational rather than tooling failures: siloed SOCs and EDR tooling without centralized visibility, thousands of false-positive alerts masking real signal, limited analyst escalation authority, and a dismissed SCCM alert whose system owner could not be identified. Organization B's rapid containment reflected the opposite: clear escalation paths and tuned alerting.
GuidePoint Security's companion blog (published 2026-08-27) provides the defender-side hunting methodology for the ESC1 abuse step of this chain: rather than relying on live CA auditing (which attackers can suppress or which may not be enabled), GuidePoint parses the CA server's underlying Extensible Storage Engine (ESE) database at Windows\System32\CertLog directly, using custom Velociraptor VQL artifacts to extract the Reque
Target sectors: government services and facilities, water and wastewater systems, critical infrastructure
Target regions: united states of america
Timeline
- CISA publishes AA26-237A, "A Tale of Two SOCs," detailing two simultaneous red team assessments against critical infrastructure organizations.
- Organization A: red team gains initial access via default credentials in a public-facing web application, then uses internal email to send phishing messages, compromising four workstations.
- Organization A: red team abuses the default Machine Account Quota (10) to create a controlled machine account.
- Organization A: red team identifies an AD CS template with CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT enabled (ESC1) and requests certificates impersonating privileged user and computer accounts.
- Organization A: red team harvests cleartext credentials from SQL Developer config files and long-lived static AWS IAM keys, reaching three sensitive business systems undetected.
- Organization A: red team steals Primary Refresh Tokens and abuses over-permissioned Entra ID applications to read security-team email and pivot into cloud resources, undetected throughout.
- Organization B: red team spearphishes users with malicious links; SOC detects and quarantines the initial compromise within 2-20 minutes.
- Organization B: red team continues under an assume-breach model, finds a cleartext SCCM service-account password, and runs DCSync to obtain the krbtgt secret.
- Organization B: red team reaches the OT DMZ bastion host but is blocked from establishing command-and-control into the OT network by outbound egress filtering.
- GuidePoint Security publishes a blog detailing how to hunt ESC1 abuse by forensically parsing the CA server's ESE database (Windows\System32\CertLog) with Velociraptor.
- GuidePoint Security identifies and fixes a go-ese library bug that misdecoded FILETIME values as OLE doubles, shipped in Velociraptor 0.76.6+.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 14 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, T1589, T1078, T1566, T1534, T1136, T1649, T1078, T1003, T1558, T1552
