A SoK / whitepaper on offensive operations against Active Directory Certificate Services.
Certificate of Compromise systematizes the offensive knowledge around Active Directory Certificate Services (ADCS) — one of the most impactful and under-scrutinized attack surfaces in modern Windows environments. It documents the complete taxonomy from first principles: the root-cause misconfigurations, their prerequisites, exploitation paths, and the detection artifacts each technique leaves behind.
The paper is published and archived on Zenodo with a citable DOI:
What it covers
The full ADCS offensive taxonomy is documented end to end, mapped against the KB5014754 enforcement landscape:
| Family | Range | Focus |
|---|---|---|
| ESC | ESC1 – ESC18 | Escalation via template and CA misconfigurations |
| THEFT | THEFT1 – THEFT5 | Credential and private-key theft |
| PERSIST | PERSIST1 – PERSIST3 | User-level certificate persistence |
| DPERSIST | DPERSIST1 – DPERSIST3 | Domain-level (CA) persistence |
Each technique is treated the same way: the misconfiguration’s root cause, the prerequisites to reach it, the exploitation steps, and the detection artifacts a defender can hunt for.
A living document
ADCS research is not static — techniques get patched, new conditions are discovered, and community analysis refines the understanding of existing ones. This paper is maintained as a living document: new techniques are added, patch-status entries are revised, and detection guidance is corrected where better signal exists. Version history is tracked in the repository.
If you find an error — technical, factual, or typographical — please open an issue or start a discussion. Pull requests for corrections are welcome. For direct correspondence, reach out on X at @thehackersbrain.
arXiv
The paper has also been submitted to arXiv cs.CR (pending endorsement). Established cs.CR authors willing to endorse can use this link: arxiv.org/auth/endorse?x=E68XML.
Companion book
A book-length treatment, Forged Trust: Offensive Operations against ADCS, extends this work into the definitive offensive reference for ADCS — covering ESC1–ESC18, THEFT1–THEFT5, PERSIST1–PERSIST3, and DPERSIST1–DPERSIST3, each documented from the misconfiguration’s root cause through exploitation and detection, alongside the KB5014754 enforcement landscape.
- Available on Amazon: Forged Trust: Offensive Operations against ADCS
Citation
@misc{raj2026certificateofcompromise, author = {Gaurav Raj}, title = {Certificate of Compromise: Offensive Operations against Active Directory Certificate Services}, year = {2026}, publisher = {Zenodo}, doi = {10.5281/zenodo.20732733}, url = {https://doi.org/10.5281/zenodo.20732733}}Written by Gaurav Raj (@thehackersbrain) ↗