Certipy and AD CS Attacks (ESC1 to ESC17): Detection and Fixes

Certipy is an open-source Python tool that finds and abuses misconfigurations in Active Directory Certificate Services (AD CS, often written ADCS), the certificate authority built into Windows Server. It reads your certificate templates and CA settings, checks for most of the escalation paths known as ESC1 through ESC17, and can turn one of them into a certificate that logs in as a Domain Admin. When Certipy appears in a penetration test report, the finding is rarely a missing patch: it is a template, CA permission or enrollment endpoint that lets an ordinary account obtain credentials for someone more privileged.

AD CS is one of the six attack-path areas in our Active Directory security assessment, a fixed $6,000 for one domain of up to a few hundred hosts, and part of every internal network penetration test (see internal penetration testing cost by size).

What Certipy is, and what it is not

Certipy is written by Oliver Lyak (ly4k) under the MIT license and published on PyPI as certipy-ad, the name Kali Linux also uses. The PyPI package called plain “certipy” is an unrelated Lawrence Livermore National Laboratory utility for creating and signing certificate authorities and certificates, so if your software inventory reports “certipy”, check which one it is.

It does five things:

• Enumeration. Reads CAs, templates, enrollment rights and CA flags over LDAP and RPC and reports which ESC conditions are met. It can also analyze exported CA registry data offline.
• Request and logon. Requests a certificate from a vulnerable template and authenticates with it through Kerberos PKINIT or Schannel.
• Relay. Relays coerced NTLM authentication to web or RPC enrollment endpoints (ESC8, ESC11).
• Changing settings. With the right permissions it rewrites a template (ESC4), makes itself a CA officer or enables a template (ESC7) and changes an account’s UPN (ESC9, ESC10, ESC16). The audit events below can catch each of those changes.
• Account takeover and persistence. Shadow Credentials (a key added to another account’s msDS-KeyCredentialLink attribute, which needs write access to that account) and “golden certificates” forged with a stolen CA key.

Its Windows counterpart is Certify, which SpecterOps announced with the original research; on Windows the certificate logon that follows is usually done with Rubeus. Certipy’s documentation says its enumeration does not directly detect ESC5, ESC10, ESC12 or ESC14 and recommends pairing it with BloodHound for the permission and mapping paths (ESC5 and ESC14), while Impacket and NetExec handle the surrounding protocol work.

Active Directory Certificate Services attacks: why AD CS leads to Domain Admin

AD CS issues certificates from an enterprise CA according to certificate templates stored in Active Directory; each template sets who may enroll, what the certificate can be used for and where its subject name comes from. A certificate with a client-authentication purpose can be exchanged at a domain controller for a Kerberos ticket, which makes it a password equivalent and a direct privilege escalation route when the certificate names a more privileged account. MITRE ATT&CK notes that a stolen or forged certificate keeps working for its validity period, even after a password reset (T1649), and whoever holds a CA’s private key can issue a certificate for any account. That is why MITRE and SpecterOps both say to treat CA servers as Tier 0, like domain controllers.

SpecterOps’ Certified Pre-Owned research (Will Schroeder and Lee Christensen, June 2021) named the first eight paths, ESC1 to ESC8. Later work added more, including Compass Security’s ESC11 (2022), SpecterOps’ ESC13 (2024) and TrustedSec’s ESC15 (2024), and Certipy’s privilege escalation documentation counts seventeen, ESC1 to ESC17, as of November 2026. AD CS abuse has been seen in real intrusions: MITRE’s T1649 entry lists APT29 among the groups that abused misconfigured AD CS templates to impersonate administrators.

ESC1 to ESC17: the AD CS attack paths in one table

Each ESC number names a condition, not an exploit.

ESC	Where	The misconfiguration	The fix
ESC1	Template	Requester supplies the name, client authentication allowed, low-privileged enrollment, no approval	Build the name from AD, narrow enrollment, manager approval
ESC2	Template	“Any Purpose” or no EKU, open to low-privileged users	Explicit EKUs, restricted enrollment
ESC3	Template	Enrollment agent template open to broad groups	Restrict enrollment, enrollment agent restrictions on the CA
ESC4	Template ACL	Low-privileged users own or can edit a template	Ownership and write rights to PKI admins only
ESC5	PKI objects	Weak permissions on the CA computer object, NTAuthCertificates, AIA or CDP	Least privilege across Public Key Services
ESC6	CA flag	EDITF_ATTRIBUTESUBJECTALTNAME2 lets any requester add an alternative name (since May 2022, mainly useful alongside ESC9 or ESC16)	Remove the flag
ESC7	CA ACL	Low-privileged users hold Manage CA or Manage Certificates	PKI admins only
ESC8	Web enrollment	Web enrollment accepts NTLM without enforcing HTTPS or Extended Protection	Remove it, or HTTPS, Extended Protection and no NTLM
ESC9	Template	A flag strips the SID security extension from certificates	Remove the flag, Full Enforcement
ESC10	DC mapping	Weak certificate mapping, such as Schannel UPN mapping	Remove UPN mapping, Full Enforcement
ESC11	CA RPC	Encrypted RPC enrollment not required, so NTLM can be relayed	Set IF_ENFORCEENCRYPTICERTREQUEST on the CA
ESC12	CA host	A low-privileged shell on a CA using a YubiHSM2 may reach the key	Treat the host as Tier 0, patch HSM software
ESC13	Issuance policy	A policy linked to an AD group grants that group’s access to enrollees	Unlink privileged groups, restrict enrollment
ESC14	Account mapping	Weak explicit mappings in altSecurityIdentities	Issuer and serial, SKI or public-key hash mappings; restrict write access to altSecurityIdentities
ESC15	Version 1 template	Unpatched CAs accept requester-supplied application policies	Install the CVE-2024-49019 update, retire version 1 templates
ESC16	CA setting	The CA omits the SID extension from every certificate	Re-enable it, Full Enforcement
ESC17	Template	Like ESC1, with a server-authentication purpose	Same as ESC1

ESC1, the one most domains have

Microsoft’s Defender for Identity guidance calls the “Supply in the request” setting one of the most common misconfigurations. A template built for an internal application or VPN lets the requester supply the name, keeps Client Authentication and is opened to Domain Users so enrollment just works. Any user can then request a certificate naming a domain administrator. Build the name from Active Directory, or, where an application truly needs supplied names, remove client authentication and require manager approval.

What a Certipy finding reveals about your environment

• A vulnerable template. Nobody owns template governance; templates get duplicated for a project and never reviewed.
• A CA flag or permission (ESC6, ESC7, ESC11, ESC16). The CA was run as ordinary infrastructure, not Tier 0, and a setting was loosened for one legacy client.
• Relay to enrollment (ESC8, ESC11). NTLM is accepted where it is not needed, and machines can be coerced into authenticating, which can turn a domain controller’s own machine account into a certificate for it.
• Weak mapping (ESC9, ESC10, ESC14, ESC16). Certificate logon still trusts names over SIDs.
• A golden certificate. The CA’s private key was reachable: the certificate equivalent of a golden ticket, where recovery usually means retiring that CA, not resetting passwords.

How to detect AD CS abuse and Certipy activity

AD CS writes its security events only when two settings are on: the “Audit Certification Services” audit subcategory on the CA server, and the CA’s own audit filter (the Auditing tab of its properties), which applies after the service restarts (Microsoft Learn). Forward the CA and domain controller logs to your SIEM. The event meanings below come from Microsoft’s Audit Certification Services, event 4768 and KB5014754 references.

Log source	Event ID	What it records	What to look for
CA Security	4886, 4887	Request received; certificate issued	Requester and issued subject are different accounts; a user enrolling in a template it never used
CA Security	4888, 4889	Request denied; set to pending	Denied requests across many templates
CA Security	4882, 4890, 4892	CA permissions, manager settings or a CA property changed	Any change without a PKI change ticket
CA Security	4885, 4896	Audit filter changed; database rows deleted	Someone covering tracks
CA Security	4898, 4899, 4900	The CA loaded a template; a template was updated; a template’s security was updated	4899 or 4900 on a published template without a change ticket (the ESC4 pattern); 4898 for a template you did not expect this CA to offer
DC Security	4768	Kerberos ticket requested; certificate issuer, serial and thumbprint filled in when a certificate was used	Certificate logons by admins or accounts that never use smart cards
DC System (Kdcsvc)	39, 41	No strong mapping (an error under Full Enforcement); certificate SID does not match the account. Event 40 (certificate older than the account) appears only in Compatibility mode	41 strongly suggests a certificate issued to someone else
DC Security	5136	Directory object modified	Template edits (needs Configuration partition auditing); changes to msDS-KeyCredentialLink
IIS on enrollment servers	n/a	Web enrollment requests	NTLM requests from domain controller machine accounts

An alternative name inside an ESC1-style request may not show in the event text, so also review issued certificates in the CA database for privileged account names. The template events are in Microsoft’s Securing PKI: Events to Monitor appendix, under the “Change CA security settings” audit filter; 4899 and 4900 carry the old and new template content, so the alert shows what changed.

The sequence matters more than any single event: a standard user reads every template, requests a certificate, and minutes later a more privileged account logs on with a certificate. With sensors on the domain controllers and the AD CS server, Microsoft Defender for Identity raises alerts for parts of that chain, including “Suspicious Domain Controller certificate request (ESC8)” and “Suspicious certificate usage over Kerberos protocol (PKINIT)” (Microsoft Learn).

An example detection rule: certificate issued, then a privileged certificate logon

Written as logic, to translate into Sigma or your SIEM’s query language:

FIRST   CA Security 4887 (certificate issued)
        where the Requester is not a Tier 0 account
        keep: Requester, Request ID, Subject, time

THEN    DC Security 4768 within 60 minutes
        where the certificate issuer, serial number and thumbprint are filled in
        and the issuer is one of your CAs
        and the account logging on is Tier 0, or differs from the 4887 Requester
        and that account has no 4887 of its own in the same window

ALERT   with the Request ID and the 4768 serial number,
        so the certificate can be found in the CA database and revoked

Exclude accounts that really do log on with smart cards or Windows Hello for Business, and widen the window if alert volume allows, since a certificate stays usable for its whole validity period. Event 4887 records the requester, request ID and subject but not the serial number, so the rule joins on account and time.

How to prevent and harden AD CS

1. Inventory, then unpublish. A template no CA publishes cannot be requested, so unpublish what nobody uses.
2. Fix the templates. No requester-supplied names on authentication templates, explicit EKUs, narrow enrollment, manager approval on anything sensitive. Free tools such as PSPKIAudit and Locksmith check for these, as do Defender for Identity’s posture assessments (ESC1-ESC4, ESC6-ESC8, ESC11, ESC15).
3. Fix the CA. Remove EDITF_ATTRIBUTESUBJECTALTNAME2, keep encrypted RPC enrollment required (on by default, but sometimes turned off to support old clients), keep the SID extension and limit Manage CA and Manage Certificates to PKI admins.
4. Close the relay paths. Remove web enrollment where nobody uses it; otherwise apply KB5005413. Our PetitPotam and NTLM relay guide has the full relay fix list, and the Active Directory hardening checklist covers coercion.
5. Enforce strong mapping. Under KB5014754, domain controllers moved to Full Enforcement in February 2025, and since the September 9, 2025 update the key that allowed Compatibility mode is no longer supported. Replace weak altSecurityIdentities mappings with issuer and serial number, SKI or SHA1 public-key mappings.
6. Patch the CAs. ESC15 is CVE-2024-49019, fixed in November 2024.
7. Run the CA as Tier 0. Tier 0 admins only, the key in an HSM where possible, an offline root.
8. Revoke, do not just reset. SpecterOps notes that resetting a compromised account’s password does not invalidate certificates issued to it. Find and revoke them.

How to find and revoke certificates issued from a vulnerable template

Fixing a template does nothing about certificates already issued, which keep working until they expire or are revoked.

1. List what the template issued. In the Certification Authority console, filter Issued Certificates by certificate template, or export the same view with Microsoft’s certutil tool: its -view verb dumps the CA database, with -restrict to filter rows. Do this on every CA that published the template.
2. Pick out the suspect ones. Look for a requester that differs from the subject or alternative name, and for privileged account names. If you cannot tell which are legitimate, plan to reissue all of them.
3. Revoke and publish. Revoke each certificate in the console or with certutil -revoke and its serial number, then publish a new CRL (certutil -CRL) so the revocation is distributed. The CA logs each revocation as event 4870.
4. Check for use. Search domain controller 4768 events for the serial numbers you revoked. A hit on a privileged account is an incident, not a hardening task.

A golden certificate forged with a stolen CA key never appears in the CA database, so it cannot be found or revoked this way, which is why that case ends with retiring the CA.

How Invadel tests AD CS

We start from one standard domain user, the access a phished employee hands an attacker. We enumerate the CAs, templates, enrollment rights, flags and endpoints, and map PKI permissions in BloodHound. We prove each condition we safely can by obtaining a certificate under the written rules of engagement. Paths that need a template or CA change to prove (ESC4, ESC7) are proven only with your written approval and are otherwise reported with the evidence that they exist. Every certificate issued to us is listed in the report so your PKI team can revoke it. Each finding names the ESC path, the exact setting, the route to Domain Admin, the fix and the events that should have fired, and the retest of your fixes is free.

Engagement	Covers	Price
Active Directory security assessment	AD CS, Kerberos (including Kerberoasting), delegation, ACL, relay and hybrid paths in one domain	$6,000
Internal network penetration test	The same plus hosts, services and segmentation	$6,000 / $9,200 / $14,500+
Red team assessment	Whether your team detects and stops the full chain	From $12,500
Purple team assessment	Defenders tune AD CS detections as each technique runs	Quoted

Prices are fixed in writing from your scoping questionnaire before work starts. See what moves the internal test price on our internal network penetration testing pricing page, compare every service on the pricing page or read a sample report.

Frequently asked questions

Is Certipy malware? No. It is an open-source, MIT-licensed security tool used by testers, defenders and attackers alike. Finding it on a host where nobody approved its use should be treated as an incident.

Can we run Certipy against our own domain? Yes, with written approval from whoever owns AD CS and a heads-up to your security team, since endpoint and identity tools may alert on it. Its enumeration only reads templates, CA settings and permissions; treat that output as conditions to fix, not proof of a path, and leave certificate requests, relay and template changes to an authorized test.

What is the difference between Certipy and Certify? Certify is C# and runs on a Windows host in the domain; Certipy is Python and runs from any machine that can reach the domain. Both produce the same CA requests and certificate logons, so the same detections apply.

Does KB5014754 Full Enforcement fix ESC1? No. It makes patched domain controllers reject Kerberos certificate logons that cannot be strongly mapped, which narrows the weak-mapping paths (ESC9, ESC16 and the Kerberos side of ESC10; Schannel mapping has its own setting). Template, CA and enrollment problems such as ESC1, ESC4, ESC7 and ESC8 stay open until fixed at the source.

What is the difference between ESC1 and ESC8? ESC1 is a template problem: a low-privileged requester can supply the name on a certificate that can be used to log on, so a user asks for one naming an administrator. ESC8 is an enrollment endpoint problem: web enrollment accepts NTLM without enforced HTTPS or Extended Protection, so authentication coerced from a machine can be relayed to it for a certificate as that machine. ESC1 is fixed in the template, ESC8 on the enrollment server.

Do certificates stay valid after a password reset? Yes. MITRE ATT&CK T1649 notes that a certificate keeps working for its validity period even after the password is reset, so revoke the certificates issued to a compromised account as well.

Will a vulnerability scanner find AD CS misconfigurations? Network vulnerability scanners mostly do not: they look for missing patches and exposed services, not template permissions or CA flags. Identity posture tools such as Locksmith, PingCastle and Defender for Identity’s assessments do flag common template and CA settings, but they report conditions; a test shows which ones a standard user can actually turn into Domain Admin.

How much does it cost to have AD CS tested? It is included in our Active Directory security assessment at $6,000 for one domain of up to a few hundred hosts, and in every internal network penetration test from $6,000, both with a free retest.

The short version

Certipy finds and abuses AD CS: templates that let users name someone else, loose CA flags and permissions, enrollment endpoints that accept relayed NTLM and weak certificate mapping. Turn on CA auditing, watch 4887 and certificate logons in 4768, fix templates and CA settings at the source and run your CAs as Tier 0. To learn which AD CS paths a standard user can walk in your domain, our Active Directory security assessment is a fixed $6,000 for one domain of up to a few hundred hosts, with a free retest. Send us your scope.