This note documents detection patterns related to ADCS ESC13 within Active Directory environments.

Direct Indicators

Log	Event ID	Meaning	Forensic Value	Notes
Security	4886	Certificate issued	Critical	Certificate issued from template allowing authentication mapping to privileged groups via EKU misuse.
Security	4887	Certificate request approved	Medium	Unexpected certificate approvals tied to authentication-capable templates.
Security	4768	Kerberos TGT request	Critical	Certificate obtained via ESC13 is used via PKINIT to request Kerberos TGT.
Security	4624	Successful logon	High	Certificate-based logon events shortly after enrollment.
Security	4672	Special privileges assigned	High	Privileged session established after certificate authentication.
Sysmon	1	Process creation	Medium	Execution of ADCS exploitation tools such as Certipy or Certify.
Sysmon	3	Network connection	Medium	Connections to CA server or domain controllers during certificate abuse.

Indirect Indicators

Indicator	What To Look For	Forensic Value	Notes
Certificate template linked to privileged group	Template EKU linked to authentication enabling group privileges	Critical	ESC13 abuses group-linked certificate templates.
Low privilege account requesting privileged authentication certificate	User requesting template granting authentication rights	High	Indicates potential abuse.
PKINIT authentication immediately after enrollment	Kerberos TGT request after certificate issuance	High	Indicates attacker leveraging certificate.
Authentication from unusual host	User authenticating from system not typically associated with account	High	Potential attacker workstation.
Administrative activity after authentication	ACL changes, group membership changes, or domain modifications	Critical	Indicates escalation following certificate abuse.

Common Tools

Tool	Usage
Certipy	Enumerates and exploits ESC13 certificate template misconfigurations.
Certify	Requests certificates from vulnerable templates.
Rubeus	Uses certificates to request Kerberos tickets via PKINIT.
BloodHound	Identifies attack paths involving vulnerable certificate templates.
ForgeCert	Used when attacker controls CA private keys.

Relevant Artifacts

Domain controller Security logs (4768, 4624, 4672)
ADCS server Security logs (4886, 4887)
Certificate Authority database
Certificate template configuration
Sysmon logs (1, 3)
PKINIT authentication telemetry
EDR telemetry identifying certificate abuse tools
Prefetch artifacts showing Certipy or Certify execution

MITRE ATT&CK References

T1649 Steal or Forge Authentication Certificates
T1550 Use Alternate Authentication Material
T1558 Steal or Forge Kerberos Tickets
T1078 Valid Accounts

Decision Tree

Is the suspicious event present?
- Identify certificate issuance events 4886 involving authentication-enabled templates.
What host generated the event?
- Determine system requesting certificate from CA.
Is the account expected to perform this action?
- Investigate low privilege users requesting authentication certificates.
Pivot:
- Source host → inspect execution of Certipy or Certify.
- Account → verify authentication method after certificate issuance.
- Network → inspect PKINIT authentication events.
Confirm exploitation
- Determine whether certificate granted privileged authentication.

Example Detection Templates

KQL

SecurityEvent
| where EventID == 4886
| summarize count() by CertificateTemplate, Requester, bin(TimeGenerated, 10m)

SecurityEvent
| where EventID == 4768
| summarize count() by TargetUserName, IpAddress, bin(TimeGenerated, 5m)

EQL

any where event.code == "4886"

Sigma

title: Suspicious ADCS Certificate Issuance ESC13
id: adcs-esc13-detection
status: experimental
description: Detects certificate issuance potentially related to ESC13 exploitation
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4886
  condition: selection
fields:
  - CertificateTemplate
  - Requester
falsepositives:
  - Legitimate certificate enrollment
level: medium
tags:
  - attack.credential_access
  - attack.t1649

Mitigation & Hardening

Control Area	Mitigation	Effectiveness	Notes
Template configuration review	Audit certificate templates with authentication EKU	Critical	Prevents privileged authentication misuse.
Enrollment permissions	Restrict certificate enrollment rights	High	Reduces abuse of sensitive templates.
Template auditing	Regularly review template security configuration	High	Detects ESC13 exposure.
Monitoring	Alert on certificate issuance for privileged templates	High	Early detection of abuse.
PKI hardening	Restrict administrative access to ADCS infrastructure	High	Reduces certificate abuse risk.