active-directory-certificate-services

1# SKILL: AD CS Attack Playbook — Expert Guide
2 
3> **AI LOAD INSTRUCTION**: Expert AD CS (Active Directory Certificate Services) attack techniques. Covers ESC1 through ESC13, certificate-based persistence, NTLM relay to enrollment endpoints, and CA misconfigurations. Base models miss enrollment prerequisite chains and ESC condition combinations.
4 
5## 0. RELATED ROUTING
6 
7Before going deep, consider loading:
8 
9- [active-directory-acl-abuse](../active-directory-acl-abuse/SKILL.md) for ACL-based attacks that enable ESC4 (template modification)
10- [active-directory-kerberos-attacks](../active-directory-kerberos-attacks/SKILL.md) for Kerberos techniques after obtaining certificates
11- [ntlm-relay-coercion](../ntlm-relay-coercion/SKILL.md) for ESC8 (relay to HTTP enrollment endpoint)
12- [windows-lateral-movement](../windows-lateral-movement/SKILL.md) for using obtained certificates for lateral movement
13 
14### Advanced Reference
15 
16Also load [ADCS_ESC_MATRIX.md](./ADCS_ESC_MATRIX.md) when you need:
17- ESC1–ESC13 quick reference table with conditions, impact, and tool commands
18- One-liner exploitation commands per ESC variant
19- Detection indicators per technique
20 
21---
22 
23## 1. AD CS ARCHITECTURE OVERVIEW
24 
25```
26Certificate Authority (CA)
27│
28├── Enterprise CA (AD-integrated, issues certs based on templates)
29│   ├── Certificate Templates (define who can enroll, what EKUs, subject settings)
30│   ├── Enrollment endpoints: HTTP (certsrv), RPC, DCOM
31…