corpus.blog
41554 blogs · 4,504,310 posts Claim your blog
Record · corpus.blog/posts/01a0d4a2-34e6-73ae-8a47-696eb1d3f97a

Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools

Unit 42 · published 11 May 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at unit42.paloaltonetworks.com Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
Links from this post
41
Words captured
3,590

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://thedfirreport.com/2025/04/28/navigating-through-the-fog/
thedfirreport.com
https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141a
cisa.gov
https://www.paloaltonetworks.com/cortex/cortex-xdr?_gl=1*13pmp8e*_ga*NzQyNjM2NzkuMTY2NjY3OTczNw..*_ga_KS2MELEEFC*MTY2OTczNjA2MS4zMS4wLjE2Njk3MzYwNjEuNjAuMC4w
paloaltonetworks.com
https://www.paloaltonetworks.com/resources/datasheets/cortex-xsiam-aag
paloaltonetworks.com
https://www.paloaltonetworks.com/cyberpedia/what-is-user-entity-behavior-analytics-ueba
paloaltonetworks.com
https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Premium-Documentation/What-is-Cortex-Cloud-Identity-Security
docs-cortex.paloaltonetworks.com
https://start.paloaltonetworks.com/contact-unit42.html
start.paloaltonetworks.com
https://learn.microsoft.com/en-us/windows/win32/seccertenroll/public-key-infrastructure
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/active-directory-certificate-services-overview
learn.microsoft.com
https://support.microsoft.com/en-us/office/digital-signatures-and-certificates-8186cd15-e7ac-4a16-8597-22bd163e8e96
support.microsoft.com
https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/certificate-template-concepts
learn.microsoft.com
https://www.paloaltonetworks.com/blog/security-operations/detecting-active-directory-certificate-services-abuse-with-cortex-xdr/
paloaltonetworks.com
https://www.rapid7.com/blog/post/2024/08/12/ongoing-social-engineering-campaign-refreshes-payloads/
rapid7.com
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26923
msrc.microsoft.com
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pkca/d0cf1763-3541-4008-a75f-a577fa5e8c5b
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview
learn.microsoft.com
https://specterops.io/blog/2021/06/17/shadow-credentials-abusing-key-trust-account-mapping-for-account-takeover/
specterops.io
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-crtd/1192823c-d839-4bc3-9b6b-fa8c53507ae1
learn.microsoft.com
https://learn.microsoft.com/en-us/azure/key-vault/certificates/create-certificate-signing-request?tabs=azure-portal
learn.microsoft.com
https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf
specterops.io
https://learn.microsoft.com/en-us/troubleshoot/windows-server/certificates-and-public-key-infrastructure-pki/add-san-to-secure-ldap-certificate
learn.microsoft.com
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-ppsec/651a90f3-e1f5-4087-8503-40d804429a88
learn.microsoft.com
https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/deploy/
learn.microsoft.com
https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/
learn.microsoft.com
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/f70afbcc-780e-4d91-850c-cfadce5bb15c
learn.microsoft.com
https://github.com/GhostPack/Certify
github.com
https://github.com/ly4k/Certipy
github.com
https://github.com/dirkjanm/PKINITtools
github.com
https://github.com/eladshamir/Whisker
github.com
https://github.com/ShutdownRepo/pywhisker
github.com
https://malpedia.caad.fkie.fraunhofer.de/details/win.fog
malpedia.caad.fkie.fraunhofer.de
https://docs-cortex.paloaltonetworks.com/p/XDR
docs-cortex.paloaltonetworks.com
https://docs-cortex.paloaltonetworks.com/p/XSIAM
docs-cortex.paloaltonetworks.com
https://www.cyberthreatalliance.org
cyberthreatalliance.org
https://research.ifcr.dk/certifried-active-directory-domain-privilege-escalation-cve-2022-26923-9e098fe298f4
research.ifcr.dk
https://posts.specterops.io/shadow-credentials-abusing-key-trust-account-mapping-for-takeover-8ee1a53566ab
posts.specterops.io
https://unit42.paloaltonetworks.com/tag/fighting-ursa/
unit42.paloaltonetworks.com
Threat Actor Groups Tracked by Palo Alto Networks Unit 42 (Updated Aug. 1, 2025) Read at the source ↗
unit42.paloaltonetworks.com
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-3.x-Documentation/Additional-setup-for-Active-Directory-Certificate-Services-ADCS-events
docs-cortex.paloaltonetworks.com
https://learn.microsoft.com/en-us/previous-versions/windows/desktop/ldap/what-is-ldap
learn.microsoft.com
https://learn.microsoft.com/en-us/sysinternals/downloads/adexplorer
learn.microsoft.com