Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools

This report from Palo Alto Unit 42 details how Active Directory Certificate Services (AD CS) is frequently exploited by both financially motivated ransomware groups and state-sponsored actors due to misconfigured templates and overly permissive enrollment rights. Attackers leverage this to escalate privileges and imper…