[Meta] Active Directory Certificate Services (AD CS) - Part 1

[w0rk3r]

Parent Epic (If Applicable)

https://github.com/elastic/ia-trade-team/issues/276

Meta Summary

Estimated Time to Complete

2 weeks

Potential Blockers

• Lack of good logs for detections.
• Integration adjustments to collect AD CS logs.

Tasklist

Meta Tasks

Beta Give feedback

1. Read Blogs and watch talks to scope the work we want to do in this meta
2. Build the Lab
3. Inspect what Logs are available
4. Integration improvements (if applicable)
5. Provide Week 1 Update or Closeout Comment
6. TBD
7. TBD
8. TBD
9. TBD
10. Provide Week 2 Update or Closeout Comment

Resources / References

• https://youtu.be/ejmAIgxFRgM
• https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf
• https://www.thehacker.recipes/ad/movement/ad-cs
• https://docs.metasploit.com/docs/pentesting/active-directory/ad-certificates/
• https://github.com/ly4k/Certipy
• https://github.com/GhostPack/Certify
• https://github.com/GhostPack/ForgeCert
• https://www.blackarrow.net/adcs-weaponizing-esc7-attack
• https://www.exandroid.dev/2021/06/23/ad-cs-relay-attack-practical-guide
• https://www.youtube.com/watch?v=TVIej2N-sYo
• https://www.youtube.com/watch?v=74GSoi_SefA
• https://mayfly277.github.io/posts/GOADv2-pwning-part6/