Microsoft Active Directory Certificate Services (Windows Server 2012 through 2025)
Microsoft's built-in system for issuing digital certificates inside a corporate Windows network — used to prove that computers and users are who they claim to be.
Root Cause
The certificate authority followed attacker-supplied directions about which server to contact during a fallback enrollment step, without first verifying it was a real Domain Controller. Microsoft's July 14 patch adds that verification check.
Attack Vector
The attacker creates or reuses a computer account, runs rogue SMB (Server Message Block — a Windows file-sharing protocol) and LDAP (Lightweight Directory Access Protocol — a directory lookup protocol) listeners, and relays the certificate authority's authentication challenge to the real Domain Controller. The CA returns a certificate for the Domain Controller. The attacker uses that certificate to request all account password hashes via DCSync (a technique that impersonates directory replication to pull credential secrets).
Detection Notes
Monitor for new computer account creation by standard user accounts. Alert on unexpected SMB or LDAP connections originating from non-server hosts. Check for DCSync operations performed by accounts that are not Domain Controllers.
Recommended Actions
- Install Microsoft's July 14 cumulative update on all AD CS hosts immediately.
- If patching is delayed, apply the chase-fallback mitigation documented in the researchers' advisory.
- Review logs for computer account creation by non-admin users in the past 30 days.