ESC1 is an Active Directory Certificate Services (AD CS) abuse pattern involving certificate templates with risky settings. In particular, a template may let an enrollee supply identity information in a certificate request while permitting enrollment in a way that can result in a certificate representing another user, potentially including a privileged account.
This matters because certificates can provide authentication to Active Directory services, so abusing a template may enable privilege escalation without stealing the target’s password. Attackers who can reach an overly permissive template may request a certificate and use it to authenticate as a more privileged identity. Defenders should review template permissions and enrollment requirements, restrict who can enroll, prevent requesters from specifying another identity where inappropriate, and monitor certificate issuance for unusual requests.