Executive Summary
Analysis from SVA Security Log details a highly effective attack chain where misconfigurations in Active Directory Certificate Services (ADCS) are leveraged to facilitate Machine-in-the-Middle (MITM) attacks. By obtaining server authentication certificates for cloud-based services like login.microsoftonline[.]com, attackers can decrypt HTTPS traffic and capture highly sensitive session cookies and OAuth access tokens.
The attack chain involves three primary stages: obtaining a trusted certificate through techniques such as ADCS ESC17 or GPO modification, hijacking DNS resolution via ADIDNS manipulation or conditional forwarders, and deploying proxy tools like mitmproxy to intercept traffic. This approach allows an adversary with an initial foothold in an on-premises environment to escalate privileges and move laterally into Microsoft Entra ID (formerly Azure AD) and other cloud-integrated SaaS platforms.
This methodology is significant because it bypasses traditional endpoint credential dumping by targeting the authentication protocol itself. Organizations relying on internal CAs for server authentication must ensure strict enrollment policies and monitor for unauthorized DNS or GPO changes to mitigate the risk of cross-environment lateral movement.