Execution Path Analysis: In the AD CS exploit flow, adversaries utilize compromised user sessions or social engineering via Microsoft Teams to invoke administrative enrollment tools (`certreq.exe` or `certutil.exe`). By specifying vulnerable templates (such as ESC1 configurations with `ENROLLEE_SUPPLIES_SUBJECT`), the attacker requests a certificate on behalf of domain administrators, achieving full forest compromise.

Structural Mitigation & Behavioral Rule: Defenders must restrict enrollment permissions on sensitive certificate templates, mandate manager approval for privileged SAN requests, and deploy endpoint process monitoring rules intercepting certreq and certutil invocations containing template flags or alternative subject parameters.

# Production Sigma Rule: Suspicious AD CS Certificate Request via Certreq/Certutil
title: Suspicious AD CS Certificate Enrollment Request via Certreq or Certutil
id: 8f9b2d41-e12a-4c78-958b-d2cf5f7682e4
status: stable
description: Detects suspicious certificate enrollment requests using certreq.exe or certutil.exe specifying custom templates or altSubjectName parameters, indicative of AD CS ESC1 abuse.
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools:
    Image|endswith:
      - '\certreq.exe'
      - '\certutil.exe'
  selection_flags:
    CommandLine|contains:
      - '-submit'
      - '-attrib'
      - 'CertificateTemplate:'
      - '-f -user'
      - 'altSubjectName'
  condition: selection_tools and selection_flags
falsepositives:
  - Legitimate automated administrative PKI deployment scripts
level: high
tags:
  - attack.credential_access
  - attack.t1649

Choke Point Mitigation: To mitigate the risk of AD CS exploitation, organizations should enforce strict certificate issuance policies and audit all certificate requests. Implementing Extended Protection for Authentication on web enrollment endpoints can prevent unauthorized certificate issuance. Additionally, deploying a Zero Trust architecture with resilient identity and access management (IAM) controls can limit lateral movement and reduce the attack surface. Regularly updating and patching AD CS configurations is also critical to prevent exploitation of known vulnerabilities.