PetitPotam/ESC8: DC machine account NTLM auth to AD CS /certsrv from non-DC host

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•4•0•8

Detects potential ESC8 NTLM relay attacks against Active Directory Certificate Services (AD CS) Web Enrollment, where a domain controller machine account authenticates over NTLM from a non-DC IP address followed by a certificate request or retrieval via IIS.