Active Directory, the modern attack surface: certificates, delegation, shadow credentials, coercion, and tickets

Kerberoasting, pass-the-hash, and DCSync are in every course, so this post goes to where modern Active Directory engagements are actually won: certificate services, delegation, the directory's own write permissions, authentication coercion, and the ticket and managed-account techniques that have appeared in the last few years. For each I give the prerequisite finding, the mechanism and the public tool that performs it (named, not carried), the detection signal, and the fix. The through-line for a defender is that almost all of it is a misconfiguration or an over-broad permission, not a memory-corruption bug, so almost all of it is closable.

Scope: assumes a domain foothold (any authenticated account) and the ability to run BloodHound. Every path below is a misconfiguration or an over-broad permission, not a memory-corruption bug, so every one of them closes to a permission, a template flag, or a patch.

The families, in short: AD Certificate Services (ESC templates and relay), shadow credentials (msDS-KeyCredentialLink), delegation and RBCD, coercion and relay, directory DACL abuse, modern ticket forgery (diamond and sapphire), and the newest managed-account abuses (gMSA, dMSA, timeroasting). Two of these have dedicated deep-dives: coerced NTLM relay to DCSync and DCSync replication abuse. A worked example that chains several of them, Kerberoast to gMSA read to a backup privilege on a DC, into full forest compromise is in four misconfigurations, no CVE.

Map before you move

Every path below is found, not guessed. BloodHound with a SharpHound or the Python collector ingests users, groups, ACLs, sessions, delegation, and certificate templates, then draws the shortest path from where you are to Domain Admin or a tier-0 asset. Detect: heavy LDAP enumeration from a single host in a short window, and ms-DS-MachineAccountQuota and certificate-template reads. The attacker's map and the defender's audit are the same graph; run it yourself first.

AD Certificate Services: the ESC family

ADCS is the richest modern surface because a certificate that allows client authentication is a durable credential, and misconfigured templates hand them out.

• ESC1. A template allows the enrollee to supply the subject and permits client authentication, and a low-privilege group can enroll. Request a certificate as any user, including a Domain Admin, then authenticate with it. Tooling: Certipy, Certify.
• ESC8. The CA runs an HTTP web-enrollment endpoint with no channel binding. Coerce a domain controller to authenticate (see coercion below) and relay that NTLM to the endpoint to obtain a certificate for the DC, which is game over. Tooling: ntlmrelayx plus a coercion tool.
• ESC6, ESC9 through ESC16. Variants: the CA honoring request-supplied SANs, weak mapping between certificates and accounts, and the certificate-mapping changes that reopened several of these. Enumerate templates and CA flags with Certipy's find.

Detect: certificate-issuance events 4886 and 4887 on the CA, enrollment for a template that normally sees none, and certificate-based logons (4768 containing certificate information) for accounts that do not use smartcards. Fix: remove ENROLLEE_SUPPLIES_SUBJECT from authentication templates, require manager approval, restrict enrollment rights, disable the HTTP enrollment endpoint or enforce channel binding and signing, and apply the certificate-mapping hardening.

Shadow credentials

If you hold GenericWrite or AddKeyCredentialLink over a target user or computer, you can add a key to its msDS-KeyCredentialLink attribute, then authenticate as that target with PKINIT and recover its NT hash with UnPAC-the-hash. It is quieter than a password reset because the target's logon still works. Tooling: Whisker, pyWhisker, Certipy shadow. Detect: writes to msDS-KeyCredentialLink (directory-change auditing, 4662 or 5136 on that attribute) and PKINIT logons for accounts that should not use certificates. Fix: monitor and restrict write access to that attribute, and treat it as tier-0 for privileged objects.

Delegation and RBCD

• Unconstrained delegation. A host configured for it caches the TGT of anyone who authenticates to it. Coerce a domain controller to it and you capture a DC TGT. Fix: eliminate unconstrained delegation, put sensitive accounts in Protected Users and mark them "account is sensitive and cannot be delegated".
• Resource-based constrained delegation (RBCD). This is the common one, because it rides on an ACL finding: if you can write msDS-AllowedToActOnBehalfOfOtherIdentity on a computer (via GenericWrite, GenericAll, or WriteDACL), set it to an account you control, then use S4U to impersonate any user to that computer, including a domain admin. Tooling: Impacket rbcd.py and getST, Rubeus. Detect: changes to that attribute (5136), and S4U2self/S4U2proxy ticket requests. Fix: restrict who can write computer object delegation attributes, and monitor the attribute.

Coercion and relay

Several MS-RPC methods let an unauthenticated or low-privilege caller force a machine, often a domain controller, to authenticate to an attacker-chosen host: PetitPotam (MS-EFSR), the printer bug (MS-RPRN), DFSCoerce (MS-DFSNM), and ShadowCoerce. The coerced NTLM is then relayed, to ADCS web enrollment (ESC8) for a DC certificate, or to LDAP to write RBCD. Tooling: Coercer, PetitPotam, ntlmrelayx. The LDAP-relay-to-DCSync path, including the CVE-2025-54918 signing bypass, is walked end to end in coerced NTLM relay to DCSync. Detect: authentication from a domain controller to a non-DC host, EFSRPC/RPRN/DFSNM calls from unexpected sources, and relay fingerprints. Fix: patch, disable NTLM where possible, enforce SMB and LDAP signing and channel binding (EPA), and remove unneeded coercion surfaces and the ADCS HTTP endpoint.

Directory permission (DACL) abuse

The directory's own ACLs are an attack surface. GenericAll or GenericWrite over a user lets you set shadow credentials or force a password; over a group lets you add yourself; WriteDACL lets you grant yourself more; WriteOwner lets you take ownership then do any of the above. BloodHound surfaces these edges directly. A GenericWrite over a user also enables targeted Kerberoasting by setting an SPN. Detect: ACL modifications (5136), group-membership changes (4728/4732/4756), and password resets (4724) on sensitive objects. Fix: a tiered administration model, least-privilege ACLs reviewed against BloodHound, and alerting on changes to tier-0 objects.

Modern ticket forgery

Beyond golden (forged TGT with the krbtgt key) and silver (forged service ticket): the diamond ticket modifies a real, legitimately issued TGT rather than forging one from scratch, so it survives several golden-ticket detections; the sapphire ticket carries a real privileged user's PAC via S4U for the same reason. Tooling: Rubeus, Impacket. Detect: TGTs with lifetimes or encryption types that do not match policy, PAC anomalies, and 4769 patterns inconsistent with normal logons. Fix: protect krbtgt as tier-0 and rotate it twice on any suspicion, enforce PAC validation, and keep AES-only where possible so RC4 downgrades stand out. Why a cross-forest golden ticket with an injected built-in SID is filtered out, and why an RC4 forge fails on a patched DC, are in why your cross-forest golden ticket is not admin.

The newest managed-account and protocol abuses

• gMSA password read. If your principal is in a gMSA's msDS-GroupMSAMembership, you can read its password blob (ReadGMSAPassword) and act as that service account. Fix: restrict the retrieval membership. Full mechanism and detection: ReadGMSAPassword, reading a managed account straight from the directory.
• dMSA abuse (BadSuccessor class, 2025). Delegated Managed Service Accounts introduced a migration path that, with write access to create or edit a dMSA in an OU you control, can be abused to inherit another account's privileges. Tooling and write-ups are public under that name. Fix: apply the vendor guidance and restrict who can create or modify dMSA objects and OU permissions.
• Timeroasting. Unauthenticated NTP authentication lets you request material tied to computer accounts and crack it offline for weak machine passwords. Fix: rotate machine account passwords on policy and monitor.
• noPac and Zerologon (CVE-2021-42278/42287, CVE-2020-1472) remain the CVE-class shortcuts to domain compromise on unpatched DCs. No exploit code here; identify patch level and detect the known artifacts (sAMAccountName changes on computer accounts, Netlogon anomalies). Fix: patch, it is the only real control.

Detection, consolidated

The highest-signal AD monitors, most of them directory-change or Kerberos events:

• ADCS issuance (4886/4887) and certificate logons (4768 with cert data) for non-smartcard accounts.
• msDS-KeyCredentialLink and delegation-attribute writes (5136/4662) on any object, especially tier-0.
• Coercion RPC (EFSRPC/RPRN/DFSNM) and DC-to-non-DC authentication.
• DCSync from a non-DC (4662 with the replication GUIDs); see DCSync replication abuse for the full detection and prevention.
• ACL, group, and password-reset changes (5136/4728/4732/4756/4724) on sensitive objects.
• Kerberos anomalies: RC4 downgrades, odd ticket lifetimes, PAC mismatches.

Turn on directory-service change auditing and Kerberos logging, and feed BloodHound your own data so you see the paths before an attacker does.

Hardening, consolidated

Tier your administration so workstation compromise cannot reach a DC; fix ADCS templates and disable or bind the HTTP enrollment endpoint; remove unconstrained delegation and lock down delegation attributes; put privileged accounts in Protected Users and mark them non-delegable; enforce SMB and LDAP signing and channel binding and disable NTLM where you can; restrict gMSA and dMSA and OU write permissions; protect and rotate krbtgt; and patch DCs promptly for the CVE-class shortcuts. Nearly every technique above closes to a permission, a template flag, or a patch.

Use

Authorized and educational use only: your own lab, a directory you own, or an engagement with written permission. This is an overview of documented techniques with the tools named, not carried, and is paired with detection and remediation so defenders can find and close these paths, not a runbook for use against systems you do not own.