ADCS ESC1 Privilege Escalation: CISA AA26-237A Red Team Findings and CA Database Hunting Methodology
ADCS ESC1 Privilege Escalation (TL-2026-2168), also tracked as ESC1, is a high-severity software vulnerability, first published 2026-08-27. It has no confirmed attribution, affects Microsoft Active Directory Certificate Services (AD CS), maps to 14 MITRE ATT&CK techniques (T1003, T1018, T1078), and is covered by 9 detection rules and 14 indicators of compromise.
Key facts for TL-2026-2168
- Threat ID
- TL-2026-2168
- Also known as
- ESC1, AD CS ESC1, Certighost
- Severity
- HIGH
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-08-27
- Last reviewed
- 2026-08-27
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government services and facilities, water and wastewater systems, critical infrastructure
- Target regions
- united states of america
- Detection rules
- 9
- Indicators of compromise
- 14
Malware and tooling in ADCS ESC1 Privilege Escalation
Malware and tooling: ADConnectDump, Certipy, Velociraptor, certreq
CISA advisory AA26-237A documents red teams exploiting the AD CS ESC1 certificate-template misconfiguration (CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT + low-privileged enrollment) to escalate from a Machine-Account-Quota-created machine account to arbitrary user/computer impersonation at two critical infrastructure organizations. GuidePoint Security's companion research shows how to hunt this abuse by forensically parsing the CA's ESE database (Windows\System32\CertLog) with Velociraptor, including a fix for a go-ese FILETIME/OLE-double timestamp bug.
How ADCS ESC1 Privilege Escalation works
On 2026-08-25 CISA published AA26-237A, "A Tale of Two SOCs: Insights From Two Red Team Assessments," comparing simultaneous red team engagements against a Government Services and Facilities Sector organization ("Organization A") and a Water and Wastewater Systems Sector organization ("Organization B"). Both red teams used comparable tradecraft and fully compromised the Active Directory domain, sensitive business systems, and cloud resources at each target, but the organizations' detection outcomes diverged sharply: Organization A's SOC never detected the intrusion, while Organization B's SOC isolated the initial workstation compromise within 2-20 minutes and forced the red team into an assume-breach posture for the rest of the assessment.
The central privilege-escalation chain in both engagements combined two Active Directory weaknesses. First, a permissive or default Machine Account Quota (ms-DS-MachineAccountQuota, 10 at Organization A and 1,000 at Organization B) let any authenticated domain user create new machine/computer accounts. Second, both environments contained AD CS certificate templates misconfigured with the ESC1 pattern -- CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT enabled alongside overly broad, low-privileged enrollment rights -- letting the requester supply an arbitrary certificate subject/SAN. By enrolling the MAQ-created machine account against the vulnerable template and supplying a privileged user's or domain controller's identity as the subject, the red teams obtained certificates that authenticated as that identity, achieving domain-level privilege escalation. CISA notes this is the same misconfiguration class behind the recently disclosed domain-takeover exploit chain nicknamed "Certighost," and cites SpecterOps' "Certified Pre-Owned" research as the foundational description of ESC1.
From that foothold, both teams harvested cleartext credentials left in accessible configuration files -- SQL Developer's connections.json and product-preferences.xml at Organization A, and a domain service-account password embedded in an SCCM XML file at Organization B -- and used DCSync to pull AD account secrets including the krbtgt hash, enabling Kerberos ticket forgery and impersonation. Organization A's team additionally found long-lived, non-expiring static AWS IAM access keys in user home directories and abused Resource-Based Constrained Delegation (via AllExtendedRights permissions) for further privilege escalation, then pivoted to Microsoft Entra ID/cloud by stealing Primary Refresh Tokens and abusing over-permissioned Entra ID applications (Graph API scopes including Mail.Read, Mail.ReadWrite, Chat.Read.All, Files.Read.All, Application.ReadWrite.All, and AppRoleAssignment.ReadWrite.All) -- including reading the security team's own communications to gauge detection status. Organization B's team used ADConnectDump to extract MSOL/Entra Connect sync credentials and abused Seamless SSO (the AZUREADSSOACC computer account's Kerberos tickets) for cloud impersonation, but was blocked from pivoting into the OT DMZ bastion host by outbound network filtering that prevented C2 callback.
CISA attributes the detection gap at Organization A to organizational rather than tooling failures: siloed SOCs and EDR tooling without centralized visibility, thousands of false-positive alerts masking real signal, limited analyst escalation authority, and a dismissed SCCM alert whose system owner could not be identified. Organization B's rapid containment reflected the opposite: clear escalation paths and tuned alerting.
GuidePoint Security's companion blog (published 2026-08-27) provides the defender-side hunting methodology for the ESC1 abuse step of this chain: rather than relying on live CA auditing (which attackers can suppress or which may not be enabled), GuidePoint parses the CA server's underlying Extensible Storage Engine (ESE) database at Windows\System32\CertLog directly, using custom Velociraptor VQL artifacts to extract the Requests, Certificates, and RequestAttributes tables without touching the live CA service. RequestAttributes exposes the template name and attacker-supplied SAN/UPN values that are the clearest signal of ESC1 abuse -- a certificate requested by a low-privileged or newly created account, against an ESC1-flagged template, carrying a SAN for a privileged identity. During this work GuidePoint identified and fixed a bug in the underlying go-ese Go library: FILETIME byte sequences were being misinterpreted as OLE Automation doubles, causing every DateTime column in the ESE database to resolve to 1899-12-30T00:00:00Z. The fix uses value-range inspection to select the correct decoder per field and shipped in Velociraptor 0.76.6+, restoring accurate timestamps for the certificate-request timeline needed to reconstruct an ESC1 attack.
MITRE ATT&CK techniques used in TL-2026-2168
Credential Access
T1003 OS Credential Dumping; T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1558 Steal or Forge Kerberos Tickets; T1649 Steal or Forge Authentication Certificates
Discovery
Initial Access
T1078 Valid Accounts; T1566 Phishing
Privilege Escalation
T1078 Valid Accounts; T1098 Account Manipulation
Defense Evasion
Collection
Persistence
Lateral Movement
T1534 Internal Spearphishing; T1550 Use Alternate Authentication Material
Reconnaissance
Affected products and versions in ADCS ESC1 Privilege Escalation
- Microsoft — Active Directory Certificate Services (AD CS)
Vulnerable versions: Any AD CS deployment with a certificate template that has CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT enabled combined with low-privileged enrollment rights (the ESC1 misconfiguration), regardless of Windows Server version
Fixed in: Templates reconfigured to disable ENROLLEE_SUPPLIES_SUBJECT, restrict enrollment to appropriate principals, and require manager approval - Velociraptor (open-source, Rapid7-sponsored) — go-ese ESE database parsing library (used by Velociraptor's CertLog/ESE artifacts)
Vulnerable versions: Versions prior to 0.76.6, where FILETIME byte sequences were misdecoded as OLE Automation doubles, resolving all DateTime fields to 1899-12-30T00:00:00Z
Fixed in: 0.76.6 and later, which added value-range inspection to select the correct FILETIME vs. OLE-double decoder
Remediation for ADCS ESC1 Privilege Escalation
Patches
- Upgrade Velociraptor to 0.76.6 or later to pick up the corrected go-ese FILETIME/OLE-double timestamp decoder
Immediate actions
- Set the Machine Account Quota (ms-DS-MachineAccountQuota) to 0 domain-wide unless a specific, documented operational need requires otherwise
- Inventory all AD CS certificate templates for CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT enabled combined with low-privileged/broad enrollment rights (the ESC1 pattern) and remediate or disable them immediately
- Hunt the CA server's Windows\System32\CertLog ESE database with Velociraptor 0.76.6+ (or later) for certificate requests where the RequestAttributes SAN/UPN identity does not match the low-privileged requester
Workarounds
- Manually audit AD CS templates for ENROLLEE_SUPPLIES_SUBJECT plus broad enrollment permissions using certutil or PSPKI while template hardening is scheduled
- Restrict or remove cleartext credential storage in developer tool configuration files (e.g. SQL Developer connections.json/product-preferences.xml) and SCCM configuration exports pending centralized secrets management
Longer-term hardening
- Require certificate manager approval and restrict autoenrollment on sensitive/impersonation-capable templates
- Move long-lived static cloud credentials (e.g. AWS IAM access keys) to temporary, SSO-issued credentials with enforced expiration
- Establish automated Primary Refresh Token / OAuth refresh-token revocation procedures and Conditional Access policies for workload identities
- Audit and reduce Graph API application permissions (Mail.Read, Mail.ReadWrite, Files.Read.All, Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All) to least privilege
- Centralize SOC visibility across all EDR/SIEM tooling, define clear analyst escalation authority, and tune alerting to reduce false-positive volume that can mask real intrusions
- Segment IT/OT networks and enforce strict egress filtering from OT DMZ bastion hosts
Weaknesses (CWE) in ADCS ESC1 Privilege Escalation
CWE-284
Timeline of ADCS ESC1 Privilege Escalation
- Organization B: red team reaches the OT DMZ bastion host but is blocked from establishing command-and-control into the OT network by outbound egress filtering.
- Organization B: red team continues under an assume-breach model, finds a cleartext SCCM service-account password, and runs DCSync to obtain the krbtgt secret.
- Organization B: red team spearphishes users with malicious links; SOC detects and quarantines the initial compromise within 2-20 minutes.
- Organization A: red team steals Primary Refresh Tokens and abuses over-permissioned Entra ID applications to read security-team email and pivot into cloud resources, undetected throughout.
- Organization A: red team harvests cleartext credentials from SQL Developer config files and long-lived static AWS IAM keys, reaching three sensitive business systems undetected.
- Organization A: red team identifies an AD CS template with CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT enabled (ESC1) and requests certificates impersonating privileged user and computer accounts.
- Organization A: red team abuses the default Machine Account Quota (10) to create a controlled machine account.
- Organization A: red team gains initial access via default credentials in a public-facing web application, then uses internal email to send phishing messages, compromising four workstations.
- CISA publishes AA26-237A, "A Tale of Two SOCs," detailing two simultaneous red team assessments against critical infrastructure organizations.
- GuidePoint Security identifies and fixes a go-ese library bug that misdecoded FILETIME values as OLE doubles, shipped in Velociraptor 0.76.6+.
- GuidePoint Security publishes a blog detailing how to hunt ESC1 abuse by forensically parsing the CA server's ESE database (Windows\System32\CertLog) with Velociraptor.
Sources cited for ADCS ESC1 Privilege Escalation
- Hunting Abuse: Detecting Privilege Escalation Through the ADCS Database
- CISA Advisory AA26-237A: A Tale of Two SOCs - Insights From Two Red Team Assessments
- CISA Advisory Highlights Red Team Findings to Help Organizations Assess Risk, Identify Threats and Enable Effective Incident Response
- CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing
- A Tale of Two SOCs: Insights From Two Red Team Assessments
- Cybersecurity Advisory A Tale of Two SOCs: Insights From Two Red Team Assessments
- A Tale of Two SOCs: Insights From Two Red Team Assessments (summary)
- CISA Red Team Compromises Active Directory and Critical Business Systems
More in vulnerability
- Click2Shell WordPress Exploit Chain Lets Attackers Gain RCE With a Single Malicious Link
- SolarWinds Access Rights Manager Hard-Coded Cryptographic Key (CVE-2026-28326) Enables Unauthenticated RCE
- CISA Flags Three Actively Exploited Linux Kernel Vulnerabilities: kTLS Receive-Path Disclosure/DoS, ebtables SNAT Privilege Escalation, and AF_ALG Race Condition (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964)
- Critical Pre-Auth RCE in Orkes Conductor Workflow Platform (CVE-2026-58138) Exploited in the Wild
- "LPE Quartet": Public Exploits Released for Four Linux Kernel Local-Root Flaws (DirtyAH6, TUNderflow, PPPoEject, DiagSpill)
Detection coverage for TL-2026-2168
As of 2026-08-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2168 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.