> ## Documentation Index > Fetch the complete documentation index at: https://docs.specterops.io/llms.txt > Use this file to discover all available pages before exploring further. # Privilege Escalation Techniques Overview > Overview of ESC1-16 privilege escalation techniques using AD CS misconfigurations and certificate template vulnerabilities. This comprehensive guide covers all 16 known ESC (Escalation) techniques for privilege escalation using Active Directory Certificate Services misconfigurations. In May 2022, Microsoft introduced **Strong Certificate Mapping**, which implemented a security extension for certificate templates that includes the security identifier (SID) of the requesting user. This was done to combat [Certifried (CVE-2022–26923)](https://research.ifcr.dk/certifried-active-directory-domain-privilege-escalation-cve-2022-26923-9e098fe298f4), and was initially released in a compatibility mode that allowed "Weak Certificate Mapping" until February 2025, after which the mode has switched to full enforcement. **Unless explicitly downgraded, every environment should be considered in full enforcement mode.** ## ESC Techniques Overview The following privilege escalation techniques exploit various misconfigurations in Active Directory Certificate Services to elevate privileges from low-privileged accounts to high-privileged accounts, including Domain Admins: ### Template Misconfigurations (ESC1-3) Exploit certificate templates that allow arbitrary Subject Alternative Names (SANs) for privilege escalation via certificate impersonation. Exploit certificate templates with overly broad Extended Key Usages (Any Purpose EKU) to bypass certificate restrictions. Abuse Certificate Request Agent templates to enroll certificates on behalf of other users. ### Access Control Vulnerabilities (ESC4-5, ESC7) Exploit overly permissive access controls on certificate templates to modify template settings. Abuse weak access controls on PKI objects including Certificate Authorities and certificate templates. Exploit vulnerable CA access controls to gain ManageCA or ManageCertificates permissions. ### CA Configuration Issues (ESC6, ESC8, ESC11) Abuse the EDITF\_ATTRIBUTESUBJECTALTNAME2 CA flag to specify arbitrary Subject Alternative Names. Perform NTLM relay attacks against Certificate Authority web enrollment endpoints. Exploit NTLM relay vulnerabilities against Certificate Authority RPC interfaces. ### Certificate Mapping Issues (ESC9-10, ESC13-16) Exploit disabled security extensions (CT\_FLAG\_NO\_SECURITY\_EXTENSION) on certificate templates. Abuse weak certificate mapping in Schannel for authentication bypass. Exploit vulnerabilities in Authentication Mechanism Assurance implementation. Abuse explicit certificate mapping configurations for privilege escalation. Exploit Application Policy injection vulnerabilities in certificate requests. Abuse disabled security extensions at the Certificate Authority level. ### Hardware-Based Attacks (ESC12) Exploit vulnerabilities specific to YubiHSM2 hardware security modules. ## General Prerequisites Most ESC techniques require: * Access to an Active Directory environment with AD CS deployed * Low-privileged domain user account * Network access to Certificate Authority servers * Understanding of PKI concepts and certificate enrollment ## Common Attack Patterns Most attacks begin with enumerating certificate templates using Certify to identify vulnerable configurations. Attackers request certificates using vulnerable templates, often specifying alternative identities or elevated privileges. The issued certificate is used for authentication, typically with Kerberos PKINIT, to obtain elevated access. ## Detection and Mitigation Organizations should implement comprehensive monitoring and hardening for Certificate Services infrastructure. * Monitor certificate enrollment events (Event ID 4886, 4887) * Track certificate template modifications * Alert on certificates with unusual Subject Alternative Names * Monitor authentication events using certificates * Regular auditing of certificate template configurations * Remove ENROLLEE\_SUPPLIES\_SUBJECT flag from templates * Implement proper template access controls * Enable manager approval for sensitive templates * Consider Strong Certificate Mapping enforcement * Regular review of CA flags and configurations Select a specific ESC technique from the categories above to learn detailed implementation steps, enumeration methods, and exploitation techniques. Each technique includes specific prerequisites, detection methods, and mitigation strategies.