Detecting ADCS Privilege Escalation

Source: Black Hills Information Security, Inc.

Author: BHIS

URL: https://www.blackhillsinfosec.com/detecting-adcs-privilege-escalation/

https://www.blackhillsinfosec.com/detecting-adcs-privilege-escalation/

ONE SENTENCE SUMMARY:

Misconfigurations in ADCS can create vulnerabilities; enabling auditing and using Sentinel helps detect and alert on credential escalations.

MAIN POINTS:

  1. ADCS manages certificates for systems, users, and applications in enterprises.
  2. Misconfigurations can lead to critical vulnerabilities in Active Directory environments.
  3. Default settings do not enable ADCS event logging; it must be manually configured.
  4. ESC1 technique allows low privileged accounts to gain elevated access.
  5. Important security event IDs for detection are 4886 and 4887.
  6. Microsoft Sentinel uses Kusto Query Language for identifying escalation activities.
  7. Alerts can be configured in Sentinel to notify on detected attacks.
  8. Sentinel alerts using Event ID mismatches for privilege misuse.
  9. Additional event IDs include 4900 for security permission changes and 4899 for template updates.
  10. Ensuring proper auditing is crucial for detection and alert configuration.

TAKEAWAYS:

  1. Enable ADCS auditing manually to detect exploitation.
  2. Use Microsoft Sentinel for continuous monitoring and alerting.
  3. Security event IDs are essential for tracking privilege escalation.
  4. Regularly update alert rules to incorporate new vulnerabilities.
  5. Stay informed about patches and updates for security enhancements.