Certipy ESC4 Privilege Escalation with Default Configuration of Certipy
Detect possible ADCS ESC4 privilege escalation using Certipy's default template hijacking. This detects a change of the security descriptor on a certificate template granting full control to the Authenticated Users group. Event ID 4886 and 4898 will typically also be generated at the same time. Afterwards, Event ID 4886 and 4887 may appear to indicate a certificate request as a high-privilege user in the UPN field.
Sigma
