This note documents detection patterns related to ADCS ESC10 within Active Directory environments.

Direct Indicators

Log	Event ID	Meaning	Forensic Value	Notes
Security	4886	Certificate issued	Critical	ESC10 exploitation results in certificate issuance using templates allowing impersonation through certificate mapping weaknesses.
Security	4887	Certificate request approved	Medium	Suspicious approval events may accompany certificate abuse.
Security	4768	Kerberos TGT request	Critical	Certificates obtained via ESC10 are commonly used for PKINIT authentication.
Security	4624	Successful logon	High	Certificate-based authentication events occurring after certificate issuance.
Security	4672	Special privileges assigned	High	Privileged session following certificate authentication.
Sysmon	1	Process creation	Medium	Execution of tools such as Certipy, Certify, or Rubeus interacting with ADCS.
Sysmon	3	Network connection	Medium	Connections to CA servers or domain controllers.

Indirect Indicators

Indicator	What To Look For	Forensic Value	Notes
Weak certificate mapping configuration	Templates allowing authentication without strict identity binding	Critical	ESC10 relies on improper mapping between certificate subject and user account.
Certificate issued for identity mismatch	SubjectUserName differs from Requester	Critical	Indicates impersonation attempt.
PKINIT authentication shortly after enrollment	TGT request following certificate issuance	High	Indicates certificate authentication.
Authentication from unusual host	Account authenticating from previously unseen workstation	High	Possible attacker host.
Administrative actions after certificate authentication	ACL modifications, account changes	Critical	Indicates attacker escalation after authentication.

Common Tools

Tool	Usage
Certipy	Enumerates and exploits ESC10 misconfigurations.
Certify	Requests certificates from vulnerable templates.
Rubeus	Uses certificates for Kerberos authentication via PKINIT.
ForgeCert	Creates forged certificates when CA keys are compromised.
Impacket	Supports certificate-based authentication operations.

Relevant Artifacts

Domain controller Security logs (4768, 4624, 4672)
ADCS server Security logs (4886, 4887)
Certificate Authority database
Certificate template configuration
Sysmon logs (1, 3)
PKINIT authentication logs
EDR telemetry detecting certificate abuse tools
Prefetch artifacts showing Certipy or Certify execution

MITRE ATT&CK References

T1649 Steal or Forge Authentication Certificates
T1550 Use Alternate Authentication Material
T1558 Steal or Forge Kerberos Tickets
T1078 Valid Accounts

Decision Tree

Is the suspicious event present?
- Identify certificate issuance events 4886 for sensitive templates.
What host generated the event?
- Determine system requesting certificate from CA.
Is the account expected to perform this action?
- Investigate mismatches between Requester and SubjectUserName.
Pivot:
- Source host → inspect execution of Certipy or Certify.
- Account → review authentication method used after certificate issuance.
- Network → inspect PKINIT authentication activity.
Confirm exploitation
- Determine whether certificate allowed authentication as another identity.

Example Detection Templates

KQL

SecurityEvent
| where EventID == 4886
| summarize count() by CertificateTemplate, Requester, SubjectUserName, bin(TimeGenerated, 10m)

SecurityEvent
| where EventID == 4768
| summarize count() by TargetUserName, IpAddress, bin(TimeGenerated, 5m)

EQL

any where event.code == "4886"

Sigma

title: Suspicious ADCS Certificate Issuance ESC10
id: adcs-esc10-detection
status: experimental
description: Detects suspicious certificate issuance potentially related to ESC10 exploitation
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4886
  condition: selection
fields:
  - CertificateTemplate
  - Requester
  - SubjectUserName
falsepositives:
  - Legitimate certificate enrollment
level: medium
tags:
  - attack.credential_access
  - attack.t1649

Mitigation & Hardening

Control Area	Mitigation	Effectiveness	Notes
Strict certificate mapping	Require strong identity binding between certificates and accounts	Critical	Prevents impersonation attacks.
Template security review	Audit certificate templates for authentication permissions	High	Detects vulnerable configurations.
Enrollment restrictions	Limit enrollment rights for sensitive templates	High	Reduces attack surface.
Monitoring	Alert on certificate issuance for privileged identities	High	Early detection.
PKI hardening	Restrict administrative access to ADCS infrastructure	High	Protects certificate services.