AD CS
Abuse Active Directory Certificate Service to achieve lateral movement and total domain compromise.
Category: AD CS
ESC1 and ESC2
Request certificate as another user with enrollee-supplied subject
Categories:
ESC3
Request certificate on behalf of another user with a enrollment agent certificate
Categories:
ESC4
Leverage vulnerable certificate access control to escalate privileges.