ESC1 Certificate Template Privilege Escalation
This rule detects network traffic to a specific URI path associated with Active Directory Certificate Services (AD CS) enrollment. The URI '/ADPolicyProvider_CEP_UsernamePassword/service.svc/CEP' is known to be used in Certificate Enrollment Policy (CEP) web services, which can be abused in ESC1 (ESC1 Certificate Template Privilege Escalation) attacks to obtain certificates with elevated privileges. The rule specifically looks for TCP traffic on port 443 (HTTPS) to this URI, indicating an attempt to interact with the CEP service.
Suricata
