DETECTING ADCS PRIVILEGE ESCALATION

Summary from the TLDR InfoSec newsletter

Active Directory Certificate Service (ADCS) is used in Active Directory environments to manage certificates for systems, users, applications, and more, and provides a variety of potential privilege escalation vectors. ADCS logging is not enabled by default and must be enabled via certsrv. This post demonstrates how to create and test KQL alerts for a common privilege escalation technique.