AD CS template abuse (ESC1–ESC3)
Enrolling in templates allowing arbitrary SAN, Any-Purpose EKU or enrollment-agent issuance
categoryIdentity, authentication and credential attacksseverityVery HighdetectabilityHighlabnot yet measured
Example: Certified Pre-Owned
Classification
27 values: 13 imported, 1 derived, 13 machine-classified. What do these mean?
Exploitability
| Attack vector | Credential attacks |
|---|---|
| Reach (CVSS) | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Attacker skill required | Medium |
| Resources required | Low |
| Likelihood / prevalence | Medium |
| Maturity | Established |
Impact & scope
| Severity | Very High |
|---|---|
| Impact | ConfidentialityIntegrity |
| Platform | Identity ProviderLinuxmacOSWindows |
| Environment | On-premises |
| Target asset class | Identity |
| Kill-chain phase (tactic) | Credential Access |
Detection & telemetry
| Detectability | High |
|---|---|
| Testability | Atomic Red Team test |
| Data sources (ATT&CK data components) | Active Directory Credential RequestActive Directory Object ModificationApplication Log ContentCommand ExecutionFile AccessWindows Registry Key Access |
Detection & response
Mitigated by 24
- M1015 attack-mitigation
- M1041 attack-mitigation
- M1042 attack-mitigation
- M1047 attack-mitigation
D3-AVEd3fendD3-CAd3fendD3-CBANd3fendD3-CEROd3fendD3-CFd3fendD3-CMd3fendD3-CPd3fendD3-CQd3fendD3-DFd3fendD3-FAd3fendD3-FEd3fendD3-FEVd3fendD3-FIMd3fendD3-LFPd3fendD3-RFd3fendD3-RFAMd3fendD3-RSd3fendD3-SBVd3fendD3-SUd3fendD3-SWId3fend
Detected by 12
- DET0240 attack-detection-strategy
2a9e4f17-6c3b-4d8a-e1f0-b57c2d94a631sigma58c0bff0-40a0-46e8-b5e8-b734b84d2017sigma6938366d-8954-4ddc-baff-c830b3ba8fcdsigma762f2482-ff21-4970-8939-0aa317a886bbsigma8b7e2c54-1f93-4a6d-b8e0-3c9d7f25a168sigma94309181-d345-4cbf-b5fe-061769bdf9cbsigma9c5d2b84-1f7e-4a3c-d6b8-e04f9a17c523sigmab2e4a719-3c8f-4d1b-a507-f83c2d56e901sigmac4a1f389-2e6b-4d9a-8f0c-b73e5a12d947sigmae2b5163d-7deb-4566-9af3-40afea6858c3sigmafa0bac5f-d170-4a91-9780-1ad71dc1f49esigma
Tested by 1
eb121494-82d1-4148-9e2b-e624e03fbf3datomic
Framework references
- Primary source: https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf
- attack: T1649 (primary)
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Identity, authentication and credential attacks' table, line 365 of Cyber-Attack-Taxonomy.md
- ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1649 as the nearest framework entries; ids verified to exist in the cached catalogues.
- ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 4 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)