Security teams can detect AD CS Domain Escalation by watching for unusual certificate template changes, unexpected certificate issuance, and requests that map to privileged accounts or elevated logon behaviour. Review directory and certificate authority activity together, and investigate any new templates, modified permissions, or certificates used for authentication outside normal administration.
What AD CS Domain Escalation Detection Should Look For
Detection works best when you treat AD CS as both a directory control plane and a certificate issuance service. The most useful signals are changes to certificate templates, new or modified enrollment permissions, and certificate issuance patterns that do not match normal administrative workflow. Teams should also watch for certificates being used to authenticate as privileged users or to produce elevated logon behaviour.
A good baseline includes who can modify templates, which templates are enabled, which accounts can enroll, and which certificate authorities normally issue certificates for each business function. AD CS Security Guide is the most direct reference for the template abuse paths and hardening patterns that shape those baselines. Without that context, it is easy to miss a malicious but syntactically valid change.
Which Activity Is Most Suspicious in Practice?
Suspicion rises when directory changes and CA events line up. A template that is newly created, suddenly made enrollable, or adjusted to allow broader subject supply is more important than an isolated issuance event. The same is true when a certificate appears for an account that does not normally obtain one, especially if that certificate is then used for interactive logon, privileged authentication, or lateral movement.
Use the surrounding identity posture to interpret the event. If a certificate maps to a privileged account, a sensitive service, or a management workflow that normally uses a different path, treat it as a high-value signal rather than a routine enrollment. Active Directory and Entra ID Hardening Guide helps place certificate activity in the broader context of privileged groups, delegation, and access boundaries.
How to Correlate AD, CA, and Authentication Telemetry
Single-log review is rarely enough. The most reliable detection comes from correlating directory object modifications, certificate authority issuance logs, and authentication events that follow certificate use. That means tracking who changed the template, who approved or enabled it, which account requested the certificate, and whether the resulting certificate was used against a privileged logon path.
This correlation matters because escalation often hides in legitimate-looking administration. A template change alone may be explainable, and a certificate issuance alone may be routine, but the combination of a privileged template edit and immediate use for authentication is much harder to dismiss. Top 10 Active Directory Security Risks is useful for placing that activity inside the broader misconfiguration and privilege-abuse patterns defenders should already be hunting.
Risk and Threat Considerations
AD CS escalation is risky because the certificate trust path can turn a small directory change into broad authentication abuse. If attackers can influence template settings, enrollment rights, or mapping behaviour, they may obtain certificates that behave like trusted credentials even when password controls remain intact.
Failure mechanism: Weak or changed template permissions, unsafe issuance settings, or poor certificate-to-account mapping can let an attacker obtain a certificate that authenticates as a more privileged identity.
Impact: The result can be domain-level privilege escalation, persistence, or stealthy authentication that blends into normal certificate use and evades password-focused monitoring.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1649 — Steal or Forge Authentication Certificates | AD CS escalation often uses forged or misissued certificates for authentication abuse. |
| Recommendation — Hunt for certificate abuse sequences and link issuance anomalies to authentication activity. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | Detecting AD CS escalation depends on monitoring template and issuance anomalies. |
| Recommendation — Monitor certificate authority and directory events for unusual changes and issuance patterns. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | The subject requires correlating directory, CA, and authentication logs for suspicious activity. |
| CM-5 — Access Restrictions for Change | Template and permission changes are central escalation points that need change restriction. | |
| IA-5 — Authenticator Management | Certificate-based authentication can be abused when credential issuance and mapping are weak. | |
| Recommendation — Review and correlate audit records across directory and CA systems for escalation indicators. Restrict and review certificate template and enrollment permission changes. Govern certificate issuance and lifecycle controls that affect authentication. | ||
Practitioner Guidance
What to verify: Confirm the normal owner, change process, and expected enrollment pattern for every template that can affect privileged authentication. Investigate any template that was created, edited, or re-enabled outside standard administration, even if the change appears small.
Decision rule: If a certificate is tied to a privileged account or a management path, prioritize containment and privilege review over trying to prove malicious intent first. That is the point where escalation risk becomes operationally material.
Practitioner takeaway: The best detection strategy is to join template change telemetry with issuance and authentication telemetry, because AD CS abuse is usually visible in the sequence, not in any single event.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org