impersonation in AD CS Attacks
Overview
impersonation is a key concept in Active Directory Certificate Services (AD CS) security. It is involved in several attack vectors that can potentially compromise the security of an AD CS infrastructure.
Related Attacks
ESC2 abuses misconfigured Enrollment Agent templates, allowing an attacker to request certificates on behalf of other users, potentially leading to privilege escalation and unauthorized access.
Mitigation Strategies
To mitigate attacks related to impersonation, consider the following strategies:
- Review and restrict access to Enrollment Agent templates
- Implement strict controls on who can act as an Enrollment Agent
- Monitor and audit certificate requests, especially those made on behalf of other users
- Implement proper certificate lifecycle management
- Use strong authentication for Enrollment Agents