Identity research is now focusing on AD CS attack paths

At a glance

What this is: This is a Netwrix research update on AD CS attack paths, highlighting certificate template abuse, suspicious enrollments, and an ESC1-style misconfiguration that can lead to privilege escalation.

Why it matters: It matters because certificate services are part of the identity attack surface, and IAM teams need to treat template enrolment and certificate issuance as governed access pathways, not low-risk plumbing.

Context

Identity security research is increasingly treating Active Directory Certificate Services as an access control problem, not just a certificate administration problem. When certificate templates can be abused to stamp identities into SAN fields or drive elevated enrolment paths, the issue sits squarely in identity governance.

Netwrix's update shows how attack-path research is moving closer to operational defence, with detection logic and policy controls built around suspicious certificate template activity. The practical question for IAM and security teams is whether certificate issuance, enrolment, and escalation pathways are being monitored as privilege-bearing identity events.

Key questions

Q: What breaks when AD CS templates are too permissive?

A: Permissive templates break the assumption that certificate issuance is tightly bound to the approved identity. When users can influence subject data or enroll more broadly than intended, the certificate can become an impersonation token and a shortcut to higher privilege in Active Directory.

Q: Why does certificate validation belong in identity governance discussions?

A: Because validation determines which domain or IP address can receive a trusted certificate, which is a governance decision about authority and lifecycle control. When the process is manual, ownership is harder to audit and renewals are slower. When the process is automated, policy, record integrity, and integration control become the real trust boundary.

Q: What are the signs that an AD CS attack path is being abused?

A: Look for unusual certificate template requests, SAN or UPN values that do not fit normal enrolment patterns, and tooling associated with privilege escalation attempts. A blocked enrolment can also be a useful signal when policy starts denying requests that previously succeeded. Those patterns show that a template is being used as an access vector.

Q: How should teams decide whether AD CS belongs in their attack-path programme?

A: If a certificate template can change who a certificate authenticates as, AD CS belongs in attack-path governance. Teams should treat any path from ordinary user access to administrative identity via certificates as a priority for monitoring, policy tightening, and review. That is the point where PKI becomes a privilege pathway, not just an infrastructure service.

Technical breakdown

How AD CS template abuse becomes privilege escalation

Active Directory Certificate Services can become an escalation path when a certificate template permits requesters to influence identity fields or enrolment conditions in ways that map a certificate back to a privileged account. ESC-style abuse usually starts with a permissive template, then uses certificate issuance as a trust bridge into higher access. Because the certificate is accepted by downstream authentication systems, the attacker does not need to break the authentication layer directly. The control failure is therefore not just about certificate content, but about which identities can request which templates and under what policy constraints.

Practical implication: review certificate template enrolment rights and remove any path that lets low-trust identities influence privileged certificate issuance.

Why SAN UPN stamping changes the risk model

Subject Alternative Name UPN stamping matters because it lets a certificate carry an identity claim that downstream systems may trust during authentication. If an attacker can cause a certificate request to include a target UPN, the certificate can function as a credential for that target identity rather than the requester. That changes the problem from certificate issuance to identity impersonation. In governance terms, the issue is the binding between requestor, certificate subject, and authentication outcome. Once that binding is weak, certificate services become an identity transformation layer rather than a neutral infrastructure service.

Practical implication: inspect template rules for SAN and UPN handling, and block any request path that allows identity claims to be user-controlled.

Why certificate attack-path research belongs in identity operations

Attack-path analysis for AD CS belongs in identity operations because it connects certificate misconfiguration to real privilege outcomes, not just to abstract policy violations. The article shows that Netwrix is building detections and policy actions around specific enrolment behaviours, which is the right level of operational specificity for identity teams. That matters because certificate issues often sit between infrastructure, IAM, and endpoint tooling, where gaps are easy to miss. A mature programme treats AD CS as part of access governance, with enforced policy boundaries around who can request, enrol, and authenticate with certificates.

Practical implication: fold AD CS into identity threat modelling, access reviews, and privilege monitoring instead of leaving it isolated in PKI administration.

Threat narrative

Attacker objective: The attacker’s objective is to use certificate template abuse to escalate from ordinary access to Domain Admin-level control.

1. Entry begins with a misconfigured certificate template that allows an attacker to request or influence a privileged certificate path.
2. Credential access occurs when the attacker obtains a certificate that authenticates as a higher-value identity instead of the requester.
3. Escalation follows when the certificate is used to reach Domain Admin or another elevated account context through trust in the template-based identity claim.
4. Impact is full privilege escalation across the directory environment, with the certificate path acting as the bridge into administrative control.

NHI Mgmt Group analysis

AD CS attack paths should now be treated as identity governance failures, not PKI edge cases. When a certificate template can be used to carry a privileged identity claim, the relevant control question is who can transform one identity state into another. That is an access governance issue with direct blast-radius implications, not a back-office certificate concern. Practitioners should bring AD CS into the identity control plane rather than leaving it in infrastructure administration.

Certificate template enrolment is the control point that matters, not just certificate issuance volume. The article's focus on suspicious template enrolments is the right lens because privilege escalation starts before a certificate exists. If template policy permits low-trust identities to request high-trust certificates, downstream authentication will faithfully accept the wrong assertion. That means identity teams need to examine request rights, subject handling, and escalation conditions together.

Escalation through AD CS is a trust-boundary problem that crosses IAM, PKI, and endpoint tooling. The same attack path can be missed if each team only sees its own layer. IAM sees enrolment, PKI sees templates, and endpoint teams see tooling like Certify.exe, but the exploit exists in the seam between them. The implication is that identity telemetry must be joined across those layers to expose the full attack path.

Template-driven privilege escalation exposes a named concept: certificate identity drift. A certificate request should represent a bounded identity assertion, but weak templates let the asserted identity drift away from the true requester. That drift turns certificates into transferable privilege tokens rather than controlled credentials. Practitioners should interpret AD CS abuse as evidence that identity binding has failed, not merely that a certificate was misused.

Research programmes that stop at detection miss the governance lesson. Blocking suspicious enrollments is useful, but the deeper signal is that certificate governance now belongs in the same conversation as privilege governance and attack-path reduction. Once templates can elevate access, the question becomes which identities are allowed to create trust, not just which certificates are allowed to exist. Security teams should align certificate policy with privilege boundaries.

What this signals

Certificate identity drift: When template rules let the asserted identity diverge from the real requester, certificates stop behaving like controlled credentials and start behaving like transferable privilege tokens. That drift is exactly why AD CS needs to sit inside identity governance rather than beside it.

AD CS attack-path research is useful because it translates a long-standing PKI weakness into an operational identity question: who can create a trust assertion that downstream systems will honour? Once that is the threat model, certificate enrolment, template ownership, and escalation monitoring all become part of the same control surface.

For practitioners

• Review certificate template enrolment rights Map every template that can influence authentication outcomes, then remove enrolment paths that let low-trust identities request privileged certificates.
• Block user-controlled SAN and UPN handling Disable or tightly constrain templates where requesters can stamp UPN values into SAN fields or otherwise shape the identity claim in the certificate.
• Add AD CS events to identity monitoring Alert on suspicious template enrolments, unusual certificate requests, and tooling patterns associated with privilege escalation attempts.
• Test for certificate-based escalation paths Validate whether any certificate template can be used to move from authenticated user access to administrative identity contexts across the directory.
• Bring PKI into access review cycles Include certificate issuance, template ownership, and revocation responsibility in access reviews so AD CS is governed as part of identity.

Key takeaways

• AD CS template misconfiguration is not a narrow PKI problem when it can be used to escalate identity and privilege across the directory.
• The article highlights suspicious certificate enrolments and SAN UPN stamping as the mechanism that can turn certificate requests into escalation paths.
• The control that matters most is who can request and shape privileged certificate templates, because that is where identity binding either holds or fails.

Key terms

• Active Directory Certificate Services: Microsoft infrastructure for issuing and managing certificates inside an enterprise directory environment. It becomes a security concern when certificate templates, enrollment permissions, or authority boundaries create durable access that survives password resets and account changes.
• Certificate template: A certificate template defines who can request a certificate, what subject details can be supplied, and how the certificate may be used. In AD CS governance, the template is effectively the policy engine, so any excessive permissions or authentication-enabled settings can create an escalation path.
• SAN UPN Stamping: The practice of placing a User Principal Name into the Subject Alternative Name extension of a certificate request or issued certificate. When poorly governed, this can let a requester influence the identity asserted by the certificate, creating impersonation and escalation risk.
• Privilege Escalation: An attack technique where a compromised identity, often an NHI with initially limited permissions, exploits vulnerabilities or misconfigurations to gain elevated access rights, typically leading to broader compromise.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.