SecureAEye LAB ONLINE · SIG 657 · DET ~41s

← All attacks / Identity, authentication and credential attacks

AD CS relay (ESC8/ESC11)

NTLM relayed to HTTP or RPC enrollment endpoints to obtain a cert

categoryIdentity, authentication and credential attacksseverityVery HighdetectabilityHighlabnot yet measured

Classification

35 values: 20 imported, 2 derived, 13 machine-classified. What do these mean?

Exploitability

Attack vector	Credential attacksNetwork attacks
Reach (CVSS)	Adjacent
Attack complexity	Low
Privileges required	None
User interaction	None
Attacker skill required	Medium
Resources required	Low
Likelihood / prevalence	Medium
Maturity	Established

Impact & scope

Severity	Very High
Impact	ConfidentialityIntegrity
Platform	Identity ProviderLinuxmacOSNetwork DevicesWindows
Environment	On-premises
Target asset class	Identity
Kill-chain phase (tactic)	CollectionCredential Access

Detection & telemetry

Detectability	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Active Directory Credential RequestActive Directory Object ModificationApplication Log ContentCommand ExecutionFile AccessFile ModificationNetwork Connection CreationNetwork Traffic ContentNetwork Traffic FlowWindows Registry Key AccessWindows Registry Key Modification

Detection & response

Mitigated by 39

Detected by 34

DET0240 attack-detection-strategy
DET0296 attack-detection-strategy
0ed99dda-6a35-11ef-8c99-0242ac120002 sigma
16f5d8ca-44bd-47c8-acbe-6fc95a16c12f sigma
2074e137-1b73-4e2d-88ba-5a3407dbdce0 sigma
2a9e4f17-6c3b-4d8a-e1f0-b57c2d94a631 sigma
3b8f4c92-6a51-4d7e-9c3a-8e2d1f5a7b09 sigma
4096842a-8f9f-4d36-92b4-d0b2a62f9b2a sigma
4627c6ae-6899-46e2-aa0c-6ebcb1becd19 sigma
50e606bf-04ce-4ca7-9d54-3449494bbd4b sigma
5588576c-5898-4fac-bcdd-7475a60e8f43 sigma
5589ab4f-a767-433c-961d-c91f3f704db1 sigma
56fa3cd6-f8d6-4520-a8c7-607292971886 sigma
58c0bff0-40a0-46e8-b5e8-b734b84d2017 sigma
679085d5-f427-4484-9f58-1dc30a7c426d sigma
6938366d-8954-4ddc-baff-c830b3ba8fcd sigma
762f2482-ff21-4970-8939-0aa317a886bb sigma
8b7e2c54-1f93-4a6d-b8e0-3c9d7f25a168 sigma
94309181-d345-4cbf-b5fe-061769bdf9cb sigma
9c5d2b84-1f7e-4a3c-d6b8-e04f9a17c523 sigma
a557ffe6-ac54-43d2-ae69-158027082350 sigma
a7c0ae48-8df8-42bf-91bd-2ea57e2f9d43 sigma
b07e58cf-cacc-4135-8473-ccb2eba63dd2 sigma
b2e4a719-3c8f-4d1b-a507-f83c2d56e901 sigma
bb0e87ce-c89f-4857-84fa-095e4483e9cb sigma
bc2e25ed-b92b-4daa-b074-b502bdd1982b sigma
c2c76b77-32be-4d1f-82c9-7e544bdfe0eb sigma
c4a1f389-2e6b-4d9a-8f0c-b73e5a12d947 sigma
cd8c163e-a19b-402e-bdd5-419ff5859f12 sigma
d22df9cd-2aee-4089-93c7-9dc4eae77f2c sigma
e2b5163d-7deb-4566-9af3-40afea6858c3 sigma
e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c sigma
ea1a07f0-3dac-47a2-aeb4-86f5379ba2b4 sigma
fa0bac5f-d170-4a91-9780-1ad71dc1f49e sigma

Tested by 2

deecd55f-afe0-4a62-9fba-4d1ba2deb321 atomic
eb121494-82d1-4148-9e2b-e624e03fbf3d atomic

Attack relationships

Child: ARP spoofing / poisoning
Child: DHCP starvation
Child: Evil twin AP
Child: LLMNR / NBT-NS / mDNS poisoning
Child: NTLM relay / name-resolution poisoning
Child: Rogue DHCP / DHCP spoofing
Child: SMB / NTLM relay

Framework references

Primary source: https://www.thehacker.recipes/ad/movement/adcs/
attack: T1649 (primary)
attack: T1557

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Identity, authentication and credential attacks' table, line 367 of Cyber-Attack-Taxonomy.md
ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1649, attack:T1557 as the nearest framework entries; ids verified to exist in the cached catalogues.
ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 4 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 9 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)