ESC8 is an Active Directory Certificate Services (AD CS) abuse pattern involving unsafe certificate enrollment or request handling. In a commonly described scenario, an attacker can relay an authenticated request to an AD CS web enrollment endpoint and obtain a certificate for an account, if the endpoint and related authentication settings are vulnerable.
The certificate may let an attacker authenticate as the targeted identity, potentially including a privileged account, without knowing its password. Defenders should assess AD CS web enrollment endpoints and authentication configurations, restrict or disable unnecessary enrollment services, and require protections such as HTTPS and Extended Protection for Authentication where supported. Monitor certificate issuance and investigate unusual enrollment activity.