exploiting-active-directory-certificate-services-esc1

SUSPICIOUS/HIGH-RISK. The skill is internally consistent with its stated red-team purpose, but that purpose is to equip an AI agent with offensive AD exploitation, privilege escalation, and credential-dumping capabilities. Its data flows and credential forwarding to external tools materially increase risk, and the external tool trust story is mixed enough to keep supply-chain concern elevated.

The material documents a high-impact AD CS ESC1 exploitation chain rather than malware embedded in a software package. It contains no evident malicious payload or obfuscation, but the commands are operationally capable of administrator impersonation and domain credential extraction. Use should be limited to explicitly authorized testing, with remediation focused on disabling enrollee-supplied subjects where unnecessary, restricting client-authentication EKUs, requiring approval, and auditing certificate-template permissions.