Step 1: PetitPotam coercion. The attacker sends an unauthenticated MS-EFSR (Encrypting File System Remote Protocol) request to a Domain Controller. The DC is coerced into authenticating back to the attacker's listener via NTLM. No credentials needed. The DC initiates the authentication.

Step 2: NTLM relay to AD CS. The attacker relays the DC's NTLM authentication directly to an AD CS web enrollment endpoint. If the CA has a certificate template with ESC1 misconfiguration (allows client authentication, allows the enrollee to specify a Subject Alternative Name, and is enrollable by low-privilege accounts), the attacker requests a client authentication certificate on behalf of the DC's machine account.

Step 3: Certificate to TGT. With a valid certificate issued in the DC's name, the attacker requests a Kerberos TGT as the Domain Controller. Full domain compromise. DCSync, Golden Ticket, game over.

1. 1. Hunt for NTLM coercion on Domain Controllers Search Security EID 4624 for NTLM authentications from unexpected, non-domain assets targeting IPC$ on the DC. Monitor EID 5140 for access to the lsarpc or efsrpc named pipes over SMB (TCP 445) from non-standard internal subnets. Security EID 4624 (NTLM logon) · EID 5140 (share access: lsarpc, efsrpc)
2. 2. Audit certificate requests for SAN abuse Search CA server logs: Security EID 4886 (Certificate Request Received) and EID 4887 (Certificate Issued). Hunt for requests where the Subject Alternative Name (SAN) field contains a domain admin or domain controller name, but the requester is a standard user or machine account. This is the ESC1 exploitation artifact. CA server: EID 4886/4887 · SAN field containing DA/DC names from low-privilege requesters
3. 3. Check for certificate-based TGT requests from wrong hosts Search Security EID 4768 (TGT Request) where a machine account requests a ticket but the source IP doesn't match the registered IP of that machine. The stolen certificate is being used from the attacker's host to authenticate as the DC. Security EID 4768: machine account TGT from non-registered IP
4. 4. Audit AD CS templates for ESC1-ESC8 misconfigurations Use Certify, Certipy, or PSPKIAudit to enumerate certificate templates. Check for: templates that allow client authentication + enrollee-specified SAN + enrollment by low-privilege users. Fix the template: remove the "Supply in the request" SAN option, restrict enrollment permissions, and require manager approval. Certify/Certipy: find /vulnerable · Hybrid AD playbook

Hybrid AD Enterprise (AD CS is part of the AD trust infrastructure)
Compromised Credentials (certificate abuse is credential abuse)
PrintNightmare (similar pattern: default Windows service becomes a domain compromise primitive)