AD CS Certificate Template Misconfiguration for Privilege Escalation
Detects the creation or update of Active Directory Certificate Services (AD CS) certificate templates that are configured with risky Extended Key Usages (EKUs) and allow the enrollee to supply the subject. This combination can be exploited for privilege escalation and credential access, as described in the 'Certified Pre-Owned' whitepaper, by allowing an attacker to request certificates with arbitrary subject names, potentially impersonating privileged accounts.
Sigma
