Lion Cipher Lab
Detect AD CS ESC1 certificate abuse from issuance logs
- SOC Analyst / Blue Team
- Advanced
- ~90 min
- Free · no account required
Why it matters
AD CS ESC1 is one of the most reliable domain-privilege-escalation paths in real breaches: a single misconfigured certificate template lets an ordinary user request a certificate that authenticates AS a Domain Admin, with no exploit and no malware — just a legitimate enrollment. It is both preventable (fix the template) and detectable (watch issuance), which makes it exactly the kind of thing a SOC should never miss. But the raw issuance logs are dominated by thousands of perfectly normal enrollments, and a naive 'a client-auth cert was issued' rule buries the one malicious request under all…
What you'll learn
- Reading AD CS certificate-issuance telemetry (Security events 4886 / 4887)
- Explaining the ESC1 template misconfiguration (enrollee-supplies-subject + client-auth EKU + low-priv enroll)
- Writing a detection keyed on the requester-identity vs SAN/subject mismatch
- Measuring detection precision and recall against a labeled dataset
- Tuning out legitimate enrollment-agent / certificate-manager false positives
- Naming ESC1's detection blind spots (ESC2/3, ESC6, ESC8, certificate theft) and data-collection gaps
Steps in this lab
- What ESC1 is, in plain terms
- The tell in the logs: requester != subject
- Why the obvious rule drowns you (the judgment)
- Generate a labeled synthetic dataset
- Write two detections and score them
- Read the confusion matrix like an analyst
- Name the blind spots your issuance logs cannot cover
- Why this matters — and where it goes next