thehackersbrain/certificate-of-compromiseSoK/Whitepaper on Offensive Operations against Active Directory Certificate Service
SoK/Whitepaper on Offensive Operations against Active Directory Certificate Service
This paper is a living document. ADCS research is not static — techniques get patched, new conditions are discovered, and community analysis refines the understanding of existing ones. As that happens, this paper will be updated: new techniques added, patch status entries revised, detection guidance corrected where better signal exists. Version history is tracked in the repository.
If you find an error — technical, factual, or typographical — please report it. Mistakes in a paper of this scope are inevitable. Open an issue or start a discussion.
Pull requests for corrections are welcome. For direct correspondence, the contact email is in the front matter of this paper, or reach out on X at @thehackersbrain.
This paper has also been submitted to arXiv cs.CR (pending endorsement). Established cs.CR authors willing to endorse can use this link: https://arxiv.org/auth/endorse?x=E68XML
SoK paper on offensive operations against Active Directory Certificate Services - ESC1-18, THEFT1-5, PERSIST/DPERSIST. |
Forged Trust: Offensive Operations against ADCS The definitive offensive reference for ADCS. Forged Trust documents the complete ADCS attack taxonomy from first principles: ESC1 - ESC18, THEFT1 - THEFT5, PERSIST1 - PERSIST3, and DPERSIST1 - DPERSIST3. Every technique is covered end to end - the misconfigurations root cause, prerequisites, exploitation, and detection artifacts - alongside the KB5014754 enforcement landscape. |
