Loading malware…
Certipy is an Active Directory Certificate Services assessment and abuse tool used to enumerate certificate authorities, certificate templates, enrollment permissions, and configuration weaknesses. It can identify exploitable certificate-template misconfigurations, including ESC1 conditions, and supports certificate-based Active Directory attack paths that can enable privilege escalation or Kerberos authentication abuse. It has been observed in post-compromise activity by the China-nexus cluster UAT-8837, which used it for Active Directory discovery and abuse while targeting critical-infrastructure organizations in North America.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The reported noPac fallback used CVE-2021-42278 and CVE-2021-42287 to request a ticket-granting ticket through the PaperCut server's domain computer account, impersonate the domain controller, and forge a high-privilege service ticket.
Where LSASS memory dumping failed, agents reportedly fell back to the noPac vulnerabilities, CVE-2021-42278 and CVE-2021-42287, using Rubeus or Certipy to obtain and forge high-privilege Kerberos tickets.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"Certipy identifies misconfigured certificate templates (ESC1). Certificate request submitted for Domain Admin."
24 distinct techniques documented for this family, organized by ATT&CK tactic.
Finally, I authenticated using the issued certificate... Authentication succeeded, allowing me to impersonate the Domain Administrator without ever knowing the Administrator’s password.
Add Shadow Credentials Same as before, we’ll create shadow credentials using Certipy: certipy-ad shadow auto ... Adding shadow creds to james account | Modify the UPN ... we’ll set it to a DC machine account — in this case, LAB-DC.LAB.LOCAL for Schannel certificate-based authentication. certipy-ad account update ... -upn 'lab-dc$@lab.local'
By default, most Active Directory domains allow authenticated users to create up to ten computer accounts. The exploit takes advantage of this default configuration by creating a machine account that the attacker legitimately owns.
Where memory dumping came up empty, the agent fell back to the noPac vulnerabilities, CVE-2021-42278 and CVE-2021-42287. | “Where memory dumping came up empty, the agent fell back to the noPac vulnerabilities, CVE-2021-42278 and CVE-2021-42287.”
Finally, I authenticated using the issued certificate... Authentication succeeded, allowing me to impersonate the Domain Administrator without ever knowing the Administrator’s password.
Add Shadow Credentials Same as before, we’ll create shadow credentials using Certipy: certipy-ad shadow auto ... Adding shadow creds to james account | Modify the UPN ... we’ll set it to a DC machine account — in this case, LAB-DC.LAB.LOCAL for Schannel certificate-based authentication. certipy-ad account update ... -upn 'lab-dc$@lab.local'
This method relies on the ability to obtain the user’s NTLM hash using the PKINIT mechanism... Got NT hash for 'administrator@contoso.com'
Once operating as a Domain Controller, the attacker inherits one of the most sensitive privileges within Active Directory: directory replication. That privilege enables DCSync, a technique that requests password data directly through the Directory Replication Service Remote Protocol rather than reading the NTDS database from disk.
Instead of first validating the destination, the CA attempted to communicate with the supplied host using SMB and LDAP. That design decision created the opportunity for attackers to position themselves directly inside the enrollment workflow.
If the certificate template lacks the required security extension (objectSid), and we control a user account, we can manipulate its attributes to request a certificate that gets mapped to a different identity, like a DA.
«ESC8 (NTLM relay на HTTP enrollment endpoint) работает даже с непривилегированной учётной записью»
Once that certificate has been issued, it can be used with Kerberos PKINIT authentication to obtain Domain Controller credentials, enabling DCSync attacks that expose the krbtgt account and effectively hand over control of the domain.
“[The agent] exploited the S4U2self flaw to impersonate the domain controller, and forged a high-privilege service ticket.”
If an attacker obtains the krbtgt secret, they can forge Kerberos tickets that are trusted by every Domain Controller in the forest until the account password is reset appropriately. | Under specific deployment conditions, the CA can be convinced to issue a certificate containing the identity of a legitimate Domain Controller even though the request originated from an attacker-controlled machine.
Step 1 — Enumerate AD CS First, I looked for vulnerable certificate templates using Certipy.
Python scripts ... ensure [tasks] have actually completed. These include tasks like administrator access, account verification, Active Directory collection, domain and network discovery.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Active Directory Certificate Services enumeration and abuse tool used to identify an ESC1 certificate-template misconfiguration and request a certificate enabling Domain Admin impersonation.
An AD CS enumeration/abuse tool used to collect certificate-related data and facilitate credential access via certificate services misconfigurations.
A tool used for Active Directory discovery and abuse, particularly in certificate services contexts.
Tool for enumerating and abusing AD CS misconfigurations to escalate privileges and obtain persistence via certificate-based attacks.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.