AD CS ACL / CA misconfiguration (ESC4–ESC7)

Templates, PKI objects or CA flags modified to mint privileged certs

categoryIdentity, authentication and credential attacksseverityVery Highdetectability (measured in our lab)Lowlabpartially detected

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1649 · Staging Local Certificates via Export-Certificate · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1649 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1649 -TestGuids eb121494-82d1-4148-9e2b-e624e03fbf3d -TimeoutSeconds 120'

ATT&CK T1649 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1649 -Tool atomic -RunId run-2026-10-14-028 -Command 'Invoke-AtomicTest T1649 -TestGuids eb121494-82d1-4148-9e2b-e624e03fbf3d -TimeoutSeconds 120'

ATT&CK T1649 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1649 -Tool atomic -RunId run-2026-10-18-011 -Command 'Invoke-AtomicTest T1649 -TestGuids eb121494-82d1-4148-9e2b-e624e03fbf3d -TimeoutSeconds 120'

+ 2 more test variant(s) in the corpus.

What our lab measured

partially detected windows · 2026-10-28 · detected in 85s

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	Access token manipulation: SYSTEM-integrity process created by a non-service parent
Sysmon · EID 1	Powershell process spawned powershell instance
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
PowerShell · EID 4104	Powershell script querying system environment variables
PowerShell · EID 4104	Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104	Powershell script searching filesystem
PowerShell · EID 4104	Powershell script used "Invoke-command" cmdlet to execute sub script
PowerShell · EID 4104	Powershell used .NET compression method, possible data extraction operation
… and 5 more event type(s)

Detection that fired

✓ Wazuh 100230 (level 10) lab rule — Access token manipulation: SYSTEM-integrity process created by a non-service parent

Plus 12 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~65823 incidental alerts/hour — tune against this.

partially detected windows · 2026-10-27

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	Powershell process spawned powershell instance
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
PowerShell · EID 4104	Powershell script querying system environment variables
PowerShell · EID 4104	Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104	Powershell script searching filesystem
PowerShell · EID 4104	Powershell script used "Invoke-command" cmdlet to execute sub script
PowerShell · EID 4104	Powershell used .NET compression method, possible data extraction operation
Security · EID 4624	Non network or service local logon.
… and 4 more event type(s)

Plus 12 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~70238 incidental alerts/hour — tune against this.

Classification

29 values: 2 lab-measured, 12 imported, 2 derived, 13 machine-classified. What do these mean?

Exploitability

Attack vector	Credential attacksMisconfiguration
Reach (CVSS)	Network
Attack complexity	Low
Privileges required	Low
User interaction	None
Attacker skill required	Medium
Resources required	Low
Likelihood / prevalence	Medium
Maturity	Established

Impact & scope

Severity	Very High
Impact	ConfidentialityIntegrity
Platform	Identity ProviderLinuxmacOSWindows
Environment	On-premises
Target asset class	Identity
Kill-chain phase (tactic)	Credential Access

Detection & telemetry

Detectability (measured in our lab)	Low
Detectability (public detection content)	High
Noise level	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Active Directory Credential RequestActive Directory Object ModificationApplication Log ContentCommand ExecutionFile AccessWindows Registry Key Access

Detection & response

Mitigated by 24

M1015 attack-mitigation
M1041 attack-mitigation
M1042 attack-mitigation
M1047 attack-mitigation
D3-AVE d3fend
D3-CA d3fend
D3-CBAN d3fend
D3-CERO d3fend
D3-CF d3fend
D3-CM d3fend
D3-CP d3fend
D3-CQ d3fend
D3-DF d3fend
D3-FA d3fend
D3-FE d3fend
D3-FEV d3fend
D3-FIM d3fend
D3-LFP d3fend
D3-RF d3fend
D3-RFAM d3fend
D3-RS d3fend
D3-SBV d3fend
D3-SU d3fend
D3-SWI d3fend

Detected by 12

DET0240 attack-detection-strategy
2a9e4f17-6c3b-4d8a-e1f0-b57c2d94a631 sigma
58c0bff0-40a0-46e8-b5e8-b734b84d2017 sigma
6938366d-8954-4ddc-baff-c830b3ba8fcd sigma
762f2482-ff21-4970-8939-0aa317a886bb sigma
8b7e2c54-1f93-4a6d-b8e0-3c9d7f25a168 sigma
94309181-d345-4cbf-b5fe-061769bdf9cb sigma
9c5d2b84-1f7e-4a3c-d6b8-e04f9a17c523 sigma
b2e4a719-3c8f-4d1b-a507-f83c2d56e901 sigma
c4a1f389-2e6b-4d9a-8f0c-b73e5a12d947 sigma
e2b5163d-7deb-4566-9af3-40afea6858c3 sigma
fa0bac5f-d170-4a91-9780-1ad71dc1f49e sigma

Tested by 1

eb121494-82d1-4148-9e2b-e624e03fbf3d atomic

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

Run	Outcome	Tool	Platform	Ran at
`run-2026-10-14-028`	partially-detected	atomic	windows	2026-10-14
`run-2026-10-18-011`	partially-detected	atomic	windows	2026-10-18
`run-2026-10-27-028`	partially-detected	atomic	windows	2026-10-27
`run-2026-10-28-022`	partially-detected	atomic	windows	2026-10-28

run-2026-10-14-028 — Backlog detectability-baseline probe (priority 5, 6 corpus attack(s); atomic_tests=1). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1649 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=16 max_level=15 dwell_s=90
run-2026-10-18-011 — Backlog detectability-baseline probe (priority 5, 6 corpus attack(s); atomic_tests=1). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1649 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1516 max_level=15 dwell_s=90
run-2026-10-27-028 — Backlog detectability-baseline probe (priority 5, 6 corpus attack(s); atomic_tests=1). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1649 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1834 max_level=15 dwell_s=90
run-2026-10-28-022 — Backlog detectability-baseline probe (priority 5, 6 corpus attack(s); atomic_tests=1). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1649 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1737 max_level=15 dwell_s=90

Framework references

Primary source: https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf
attack: T1649 (primary)

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Identity, authentication and credential attacks' table, line 366 of Cyber-Attack-Taxonomy.md
ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1649 as the nearest framework entries; ids verified to exist in the cached catalogues.
ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 4 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0004 (Phase 4 detection lab - detonation runs 2026-10-14) — Lab detonation run-2026-10-14-028 (partially-detected) for T1649: no alert matched the expected technique
ev-0005 (Phase 4 detection lab - detonation runs 2026-10-18) — Lab detonation run-2026-10-18-011 (partially-detected) for T1649: no alert matched the expected technique
ev-0006 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-028 (partially-detected) for T1649: no alert matched the expected technique
ev-0007 (Phase 4 detection lab - detonation runs 2026-10-28) — Lab detonation run-2026-10-28-022 (partially-detected) for T1649: no alert matched the expected technique