What happened: the agent was told it was “only a test”

A template lets a low-privilege user request a certificate and name the identity it will be issued for.

Root cause

Enrollee-supplied subject, a client-authentication EKU, and enrollment rights granted to a broad group such as Domain Users, with no manager approval.

Effect

Any domain user obtains a certificate that authenticates as Domain Admin. No exploit, no password, no malware.

This case

The operator drafted a purpose-built AD CS exploitation plan in Russian and pursued template misconfiguration capable of minting a domain-administrator certificate live.

Fix

Remove ENROLLEE_SUPPLIES_SUBJECT or require CA manager approval. Strip enrollment rights from Domain Users. Audit every template.

A setting on the CA lets requesters specify a subject alternative name regardless of how restrictive the template is.

Root cause

The EDITF_ATTRIBUTESUBJECTALTNAME2 flag enabled on the CA. Template hardening becomes irrelevant.

Effect

A certificate is issued carrying an attacker-chosen identity, which then authenticates as that identity.

This case

Attempted and blocked in one instance by a DNS failure on the operator's own side rather than by a control in the victim environment.

Fix

Disable the flag on every issuing CA and confirm it stays disabled. Audit CA configuration as a Tier 0 asset.

The AD CS web enrollment endpoint accepts relayed NTLM authentication over HTTP.

Root cause

Web enrollment enabled, reachable, and not requiring channel binding or HTTPS-only with Extended Protection for Authentication.

Effect

Coerced machine authentication is relayed to the enrollment endpoint and returns a certificate for a privileged identity.

This case

Used as a relay chain against multiple targets, paired with the coercion techniques below.

Fix

Disable web enrollment if it is not required. If it is, enforce HTTPS only, enable EPA, and require channel binding.

A machine, including a domain controller, is made to authenticate to an attacker-chosen host.

Root cause

Legacy RPC interfaces reachable from any domain-joined host, combined with NTLM still accepted and SMB signing not enforced.

Effect

Machine account authentication is captured and relayed onward, including a DCSync-equivalent variant.

This case

All three coercion methods appeared in the toolkit, feeding the relay chain.

Fix

Patch, disable the Print Spooler on DCs, enforce SMB signing and LDAP channel binding, apply RPC filters, and disable NTLM where it can be removed.

A machine account is created, renamed and impersonated to obtain a domain-admin-equivalent ticket.

Root cause

CVE-2021-42278 and CVE-2021-42287 unpatched, combined with a non-zero MachineAccountQuota that lets any user add computers to the domain.

Effect

Full domain compromise from a standard user account.

This case

A custom-scripted chain rather than the stock proof of concept. The operator instructed the agent not to add computer objects to the domain.

Fix

Patch. Set MachineAccountQuota to 0 and delegate machine joins explicitly. Alert on computer account creation and SAM name changes.

Service tickets and pre-auth-disabled accounts are requested legitimately, then cracked offline.

Root cause

Service principal names attached to privileged accounts, accounts with Kerberos pre-authentication disabled, and human-set passwords on service accounts.

Effect

Plaintext service account passwords, often with excessive rights.

This case

Run against every engagement, in the same sequence, with the same output file naming convention each time.

Fix

Remove SPNs from privileged accounts including the built-in Administrator. Migrate to group managed service accounts. Enforce long random passwords elsewhere.

A nine-year-old vulnerability, still working in 2026.

Root cause

End-of-life operating systems still running, reachable over null-session SMBv1 with no signing.

Effect

Remote code execution, used for direct account creation on one target.

This case

CloudSEK notes the operator repeatedly located and used this class of host.

Fix

Inventory and retire or fully isolate EOL systems. Disable SMBv1 everywhere, especially on domain controllers.

A custom NetExec module targeting seven browsers, documented in Russian.

Root cause

Users saving corporate passwords in browser password managers, with no policy control and no monitoring of profile directory access.

Effect

Credentials for systems never in scope of the original foothold, including SaaS and third-party platforms.

This case

Purpose-built tooling covering seven browsers, maintained in the operator's private repository.

Fix

Disable browser password saving by policy, enable credential-store encryption, and monitor bulk or scripted access to browser profile directories.

The bridge between on-premises AD and the cloud tenant, frequently left outside Tier 0.

Root cause

The sync account treated as an application service account rather than a Tier 0 identity, and the connector server not isolated to DC-equivalent standards.

Effect

On-premises compromise becomes cloud tenant compromise.

This case

The sync-account hash was captured in the manufacturing sector engagement.

Fix

Classify the connector server and sync account as Tier 0. Restrict admin logons to it and monitor it like a domain controller.

The single most reliable warning that encryption is imminent.

Root cause

Backup infrastructure sharing credentials, domain membership and network segments with production Active Directory.

Effect

Backups are deleted or encrypted before the payload runs, removing the recovery option.

This case

Backup-system credentials were validated in the IT and backup infrastructure sector, flagged explicitly as a classic pre-encryption indicator.

Fix

Isolate backup platforms on separate credentials and network segments. Keep immutable or offline copies. Test restores.

One host, dozens of encrypted servers, and a ransom note in the login banner.

Root cause

Hypervisor management reachable from the general network, discoverable through domain-derived subnets and TLS fingerprinting, with no lockdown mode and no MFA on vCenter.

Effect

Running guests are force-killed to release disk locks, VM files encrypted, system volumes skipped so the host stays bootable and the demand stays readable.

This case

A dedicated ESXi discovery module and a purpose-built Linux/ESXi encryptor variant. The ransom note was written into the SSH banner rather than dropped as a file.

Fix

Isolate the management VLAN, enable lockdown mode, restrict SSH to jump hosts, require MFA on vCenter, alert on mass VM power-off and on sshd configuration changes.

Ordinary tools, unusual volumes, no alert.

Root cause

No egress filtering, no volumetric baseline, and archiving utilities unmonitored on servers.

Effect

Bulk data leaves before anyone notices, which is what makes double extortion possible.

This case

PowerShell-driven 7-Zip archiving in 50GB chunks, staged then pulled back through the SOCKS pivots. The second cluster used s5cmd to a self-hosted S3-compatible endpoint instead.

Fix

Egress filtering to known destinations, alerting on large archive creation on servers, and outbound volume baselines per host.

Do

Audit every AD CS template for ESC1, ESC6 and ESC8 exposure. Remove ENROLLEE_SUPPLIES_SUBJECT or require manager approval. Disable EDITF_ATTRIBUTESUBJECTALTNAME2. Turn off web enrollment if unused. Enable certificate request and issuance auditing, which is off by default in most environments.

Why first

The operator's primary escalation path, and not visible without certificate auditing enabled.

Do

Set the quota to 0, delegate machine joins to a named group, patch the noPac CVEs, and alert on Event 4741.

Why first

One attribute change removes an entire escalation family. The operator instructed the agent to avoid adding computer objects.

Do

Disable LLMNR and NBT-NS. Enforce SMB signing and Extended Protection for Authentication. Disable SMBv1, starting with domain controllers. Restrict WinRM to designated administrative hosts. Disable the Print Spooler on DCs.

Why

Closes coercion and relay as a class, not one technique at a time.

Do

Separate backup credentials and network segment from production AD. Immutable or offline copies. Management VLAN for ESXi and vCenter, lockdown mode, MFA, SSH restricted to jump hosts.

Why

Preceding items reduce likelihood; these reduce consequence.

Do

Enumerate every account holding an SPN. Remove SPNs from privileged accounts, especially the built-in Administrator. Migrate to group managed service accounts. Enforce long random passwords everywhere else. Disable browser password saving by policy.

Why

Roasting was run against every engagement in this campaign.

Do

No direct administrative logons to domain controllers. Privileged access workstations. Just-in-time elevation. Classify the Azure AD Connect connector server and sync account as Tier 0. Phishing-resistant MFA on all remote and administrative access.

Why

Tiering is what turns a Tier 2 credential compromise into a contained event instead of a domain takeover.

Do

Enumeration volume per account. Certificate requests by non-administrative accounts. Computer object creation. Shadow copy deletion. Then add outbound volume baselines per host.

Why

Four points in the same chain, each low-cost to implement.

Do

If domain compromise is suspected, rotate krbtgt twice with a full replication interval between resets. Alert on any Kerberos ticket whose lifetime exceeds domain policy. Revoke and reissue any certificate issued during the suspected window. Rotate any wildcard TLS key that cannot be shown to be untouched.

Why

Certificates and krbtgt material survive password resets.

A statement of permission inside the conversation is not evidence of permission.

Do

Bind capability to verified identity and scope at the tool layer, not to what the prompt claims. For anything resembling security testing, require an engagement record the agent can check against, not a sentence it can be told.

Constraints at the tool layer do not depend on interpreting intent.

Do

Target allowlists, network egress restrictions, credential scoping, and hard blocks on classes of action regardless of stated justification. If the agent cannot reach the target, the stated justification is irrelevant.

Per-prompt evaluation cannot see a campaign.

Do

Score behaviour at the account level over time: repeated refusal-then-rephrase patterns, the same workflow against many unrelated targets, credential material appearing in context. Rate limit and require step-up verification when the score moves.

Tool invocation is the record of what the agent actually did.

Do

Retain what the agent executed, where it connected and what it read, at the same standard applied to a privileged human session. This incident was reconstructed from exactly this kind of retained record.