Certighost Active Directory Certificate Services Privilege Escalation

Technical Analysis

Certighost abuses weaknesses in Active Directory Certificate Services (ADCS) certificate templates or enrollment logic to let a low-privileged principal obtain a certificate bound to a Domain Controller machine account. Because DC accounts hold the Directory-Replication-Get-Changes-All permission, the forged Kerberos ticket derived from this certificate can be used to invoke DCSync (via tools like mimikatz or secretsdump) and exfiltrate the krbtgt hash, allowing golden ticket forgery and persistent domain-wide access. This is conceptually related to prior ADCS abuse techniques (e.g., ESC1–ESC8 classes such as CVE-2022-26923 and CVE-2021-42287/42278) but represents a novel exploitation path specific to DC certificate impersonation; no official CVE has been assigned as of publication. Exploitation requires only a foothold as any domain-authenticated user with certificate enrollment access, making it a high-value target for post-compromise lateral movement and privilege escalation in enterprise AD environments. Organizations running AI agent orchestration platforms, RAG pipelines, or LLM tool-use frameworks on domain-joined Windows infrastructure are directly at risk: compromise of the krbtgt secret grants attackers persistent access to service accounts and stored API keys/secrets used by agent frameworks (e.g., in vaults, CI/CD, or credential stores integrated with AD), enabling downstream supply-chain-style compromise of agent pipelines and exfiltration of proprietary model data or credentials.

Affected Systems

Windows Active Directory environments with Active Directory Certificate Services (ADCS) deployed; Domain Controllers running vulnerable or misconfigured certificate templates; environments allowing low-privileged user certificate enrollment; Windows Server 2016/2019/2022 domain controllers with ADCS role enabled

Indicators of Compromise

• No public IOCs disclosed at time of publication (research-stage exploit)
• Associated PoC name: Certighost
• Watch for anomalous certificate enrollment requests for Domain Controller templates
• Watch for anomalous DCSync activity from non-DC accounts (Event ID 4662 with Directory-Replication-Get-Changes-All)
• Unusual Kerberos TGT requests using machine-account-style certificates

Remediation Steps

1. 1

   Audit ADCS Certificate Templates

   Review all certificate templates for overly permissive enrollment rights, especially those allowing low-privileged users to request certificates impersonating Domain Controller or machine accounts.

2. 2

   Apply Least Privilege to Certificate Enrollment

   Restrict enrollment permissions on sensitive templates to only authorized administrative groups; remove Domain Users/Authenticated Users from enrollment ACLs where not required.

3. 3

   Enable Enhanced Auditing

   Turn on detailed auditing for certificate issuance (Event ID 4886/4887) and DCSync-related replication events (Event ID 4662) to detect abuse in real time.

4. 4

   Deploy Microsoft's ADCS Hardening Guidance

   Apply Microsoft-recommended ADCS security baselines, including disabling SAN specification in certificate requests and enforcing strong mapping for certificate-based authentication (KB5014754).

5. 5

   Monitor and Rotate krbtgt

   If compromise is suspected, rotate the krbtgt account password twice in succession to invalidate forged Kerberos tickets, and monitor for repeated golden ticket usage.

6. 6

   Secure Agent and Service Credentials

   For organizations running AI agent frameworks on domain-joined infrastructure, rotate and vault any API keys or service credentials tied to AD-integrated identity stores, and enforce short-lived credential issuance to limit blast radius from domain compromise.