Hunting For ADCS Abuse

Date: 21/2/24 ~ Creator: Malcolm L.

TLDR

In this breakdown, I created an overview of ADCS concepts, incorporating adversaries attack path for abusing misconfigurations in ADCS (Active Directory Certificate Services) to gain DA (Domain Admin) rights within a network. Additionally, I built a detection rule based on KQL syntax that you can input into any XDR/SIEM solution of your choice.

MITRE ATT&CK: Severity: Critical

Technique ID	Title	Technique
T1649	Credential Access	Steal or Forge Authentication Certificates

OSINT

https://www.crowe.com/cybersecurity-watch/exploiting-ad-cs-a-quick-look-at-esc1-esc8

Custom Detection Rule 🤺

# Author: Malcolm L. 0xM

#Add the detection query below to your secuirty solution to mitigate/detect unauthorized access aginst CA servers in your internal ORG. 
#Note:If your security tool does not accept KQL, convert the syntax to the acceptable language. 

#Scope: Set to all endpoints or specific device groups. Frequency: Every 12hr or 3hr. 

SecurityEvent 
| extend ADCSEventIds = dynamic([4898, 4890, 4896, 4887, 4886, 4882])
| where EventID = ADCSEventIds
| project ADCSEventIds, TimeGenerated, RequestedId, Requestor, SourceSystem, AccountName, CACertificateHash 
| order by TimeGenerated desc

About ADCS

ADCS is a window server role for issuing and managing public key infrastructure(PKI) certificates used in secure communication and authentication protocol.

~ Digital certificates can be used to encrypt and digitally sign electronic documents and messages as well as for authentication of computers, users, or device accounts on the network.

Confidentiality through protection.
Integrity through digital signatures.
Authentication by associating keys(Public/Private) with the computer, user, or device accounts on a computer network.

Certificate Authorities: Issuing and managing digital certificates.

Certificate Template: A set of predefined settings and policies that determine how a digital certificate should be structured.

ADCS Vulnerability ESC1

Is a privilege escalation attack that targets misconfigured certificate templates. It allows a low-privileged users to enroll and request a certificate on behalf of any domain user.

Remediation: Disable or delete the impersonated account from the CA under “Issued Certificates” →

“KDC_ERR_CLIENT_REVOKED”

Threat Actor TTP

Compromise the credentials of a low-priv AD user or service account.
Use the harvested creds to enroll a new host on the domain.
Enumerate certificate template.