Tear Down The Castle - Part 1

What it is

Part 1 of DFIR.ch's analysis of 250 PingCastle reports from real IR and compromise-assessment engagements, mapping "The Ten AD Commandments" to specific PingCastle findings. This part covers two categories: Active Directory Certificate Services (AD CS) template abuse and service account hygiene. Each finding carries an "Affected Domains: N/250" prevalence figure.

How it works

The AD CS attack turns on certificate template permissions. If ENROLLEE_SUPPLIES_SUBJECT is set (controlled via the msPKI-Certificate-Name-Flag attribute), a requester can specify an arbitrary subject — including a domain admin — and, when the template also grants Client Authentication (PkiExtendedKeyUsage) with enrollment rights to NT Authority\Authenticated Users, any authenticated user can mint a certificate impersonating a privileged account and exchange it for a Kerberos TGT (via SpecterOps' Certify). The service-account risk is Kerberoasting: weak passwords on privileged accounts allow offline cracking of TGS tickets, compounded by non-expiring passwords and accounts sitting in Domain Admins.

Preconditions / Affected

Two distinct AD CS misconfigurations, tracked separately:

• A certificate template editable by anyone — attacker rewrites obscure attributes to enable subject control. 19/250 domains.
• A template whose subject can be modified at issuance time. 24/250 domains.

Service accounts:

• No service-account password policy. 240/250 domains — the near-universal finding.
• Non-expiring-password accounts that are domain administrators (statistic truncated in fetched text).

What to do

• Run PingCastle and treat these specific findings as prioritized triage items; the post's value is telling you which are common enough to expect in your own environment.
• Audit certificate template ACLs and the ENROLLEE_SUPPLIES_SUBJECT flag; remove write access for low-privilege principals and disable requester-supplied subjects on authentication-capable templates.
• Enforce a service-account password policy: the page recommends 20+ character passwords to make Kerberoasting's offline cracking infeasible.
• Remove service accounts from Domain Admins and eliminate non-expiring passwords on privileged accounts.

Caveats

This is an analysis piece, not an advisory — it references the Certified Pre-Owned whitepaper and Certify but reproduces no full exploit commands (screenshots and steps are sourced secondhand from ired.team). The stats reflect this specific 250-domain corpus of incident/assessment cases, which skews toward already-troubled environments and is not a general population baseline. Part 1 covers only AD CS and service accounts; the remaining commandments are elsewhere.