AD CS - 1

security: From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths

Microsoft describes an intrusion path that began with help desk impersonation and progressed to remote access, malicious runtime execution, and abuse of Active Directory Certificate Services (AD CS). The post focuses on ESC1 and ESC8 techniques involving authentication relay and Kerberos.