AD CS Escalation: A Hands-On Agent Skill for ESC1–ESC17

Where this fits

You're a security engineer running a penetration test or red team exercise. You've enumerated Active Directory and found a Certificate Authority (CA). You suspect misconfigured certificate templates could let a low-privileged user impersonate a Domain Admin. Instead of digging through Microsoft docs and Certipy's sparse help, you need a concise playbook that tells you exactly which ESC applies, the command to run, what it checks, and how to remediate. That's where the adcs-attacks skill comes in.

Why agents benefit

• Instant ESC identification: After running certipy find, the skill maps output to ESC1–ESC17, so the agent can immediately explain which vulnerability is present and why.
• Exact commands, no guesswork: Each ESC includes the precise Certipy invocation for requesting a certificate, enabling the agent to execute the attack with confidence.
• Contextual remediation: The skill pairs each technique with the specific Windows Event IDs and configuration changes needed to fix the CA, turning a red-team finding into a blue-team action item.
• Field-tested prioritization: It highlights ESC1 and ESC8 as the most common in real environments, so the agent can focus on what matters.
• Self-contained workflow: From enumeration to certificate request to cleanup, the skill provides a complete, step-by-step path that an agent can follow without external lookups.

Practical scenarios

Scenario 1: Rapid assessment of a CA during a pentest

You're given a foothold as a standard domain user. The skill guides the agent to run certipy find with the target DC, parse the vulnerable templates, and determine if ESC1 (enrollment agent with extended key usage) is exploitable. The agent then requests a certificate for the Administrator user and authenticates to the DC, all with the correct commands.

Scenario 2: Incident response and hardening

You've discovered a CA that was compromised. The skill helps the agent walk through each ESC to identify which misconfigurations existed, map them to the relevant Event IDs (e.g., 4886 for certificate request), and propose remediation—like disabling the vulnerable template or enforcing CA policy restrictions.

Scenario 3: Training and documentation

You're preparing an internal AD security workshop. The skill serves as a reference for each ESC, complete with Certipy examples and Windows event logs, letting the agent generate lab notes or a report for stakeholders.

Add it to your agent workflow

Install the skill using the OpenAgentSkill CLI:

npx skills add ADScanPro/Claude-AD --skill adcs-attacks

Then, in your agent prompt, ask it to use the skill. For example:

Use the adcs-attacks skill to enumerate the CA at dc01.corp.local, identify any vulnerable templates, and if ESC1 is present, request a certificate for the krbtgt account.

The agent will invoke Certipy, parse the output, and guide you through the attack and remediation steps.

Compare before adopting

Before adding this skill, compare it with other AD security skills or manual scripts. Look at the freshness of the Certipy version it references (ly4k updates frequently), the depth of coverage for ESC1–ESC17 (some tools only cover the first few), and whether the skill includes remediation details beyond just commands. Also, consider how well it integrates with your agent's existing tooling—does it rely on BloodHound or other plugins? Finally, assess the maintainer's activity (ADScanPro has 165 stars and a public GitHub repo) and whether the skill's structure matches your team's reporting needs.

Why it is worth tracking

This skill stands out because it's actively maintained, evidenced by the 165-star GitHub repo and the author's engagement with the community. The coverage of all 17 ESC techniques is rare, and the emphasis on ESC1 and ESC8 aligns with real-world attack patterns. For developers building security-focused agents, this skill is a reliable, up-to-date reference that turns raw Certipy output into actionable intelligence. Track it if you need to automate AD CS assessments or want to embed certificate-based escalation knowledge into your agent. For more details, see the skill page on OpenAgentSkill.

---

Word count: ~520