srl
ADCS Attacks
Active Directory Certificate Services (ADCS) issues certificates that can be used for Kerberos PKINIT authentication. A misconfigured template or CA lets a low-privileged user obtain a certificate as another user — often a Domain Admin or a domain controller — and authenticate with it, no password cracking required. Certificate-based auth survives password resets, and it is frequently out of scope for MFA and Conditional Access policies, which is why AD CS paths are disproportionately valuable for persistence as well as escalation.