SC-033: ADCS Golden Certificate Attack — Operation Gilt Seal¶

Threat Actor Profile¶

GOLDEN CIPHER is a nation-state espionage group active since 2023, specializing in Active Directory infrastructure attacks against defense contractors, aerospace firms, and government suppliers. Unlike ransomware-focused groups, GOLDEN CIPHER operates with extreme patience — average dwell time exceeds 180 days — and prioritizes persistent, undetectable access to classified and controlled unclassified information (CUI).

The group demonstrates advanced understanding of Microsoft PKI infrastructure, Active Directory Certificate Services, and Kerberos authentication internals. Their signature tradecraft involves exploiting misconfigured AD CS certificate templates (ESC1–ESC8 vulnerabilities) to forge authentication certificates that bypass traditional credential-based detection. Once they obtain a CA certificate and private key, they create golden certificates — forged certificates that authenticate as any domain user, including domain admins, indefinitely.

Motivation: Espionage — exfiltration of defense program documentation, weapons system specifications, supply chain intelligence, and personnel security clearance data. Secondary objective: establish persistent access for long-term intelligence collection across the defense industrial base (DIB).

Scenario Narrative¶

Phase 1 — Initial Access and Reconnaissance (~40 min)¶

GOLDEN CIPHER gains initial access through a spear-phishing email targeting a project engineer (jthompson@pinnacle-defense.example.com) working on the AEGIS radar program. The email impersonates a subcontractor and contains a malicious OneNote attachment that drops a Cobalt Strike beacon via DLL sideloading. The beacon establishes C2 communications to 198.51.100.44 over HTTPS port 443, blending with legitimate outbound traffic.

From the compromised workstation (WKST-ENG-047, 10.10.5.47), GOLDEN CIPHER conducts internal reconnaissance focused on AD CS infrastructure. They use Certify.exe (renamed to msdiag.exe) to enumerate certificate templates, CA servers, and enrollment permissions.

Evidence Artifacts:

Phase 2 — Certificate Template Enumeration and ESC1 Exploitation (~50 min)¶

GOLDEN CIPHER's Certify enumeration reveals a critically misconfigured certificate template: PinnacleUserAuth. This template exhibits the ESC1 vulnerability — it allows enrollees to specify a Subject Alternative Name (SAN) in the certificate request, enabling any authenticated user to request a certificate for any other user, including domain administrators.

Vulnerable Template Configuration:

Template Name:            PinnacleUserAuth
Schema Version:           2
Validity Period:          1 year
Renewal Period:           6 weeks
Enrollment Permissions:   PINNACLE\Domain Users (Allow Enroll)
                          PINNACLE\Domain Computers (Allow Enroll)
msPKI-Certificate-Name-Flag: ENROLLEE_SUPPLIES_SUBJECT (CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT)
pKIExtendedKeyUsage:      Client Authentication (1.3.6.1.5.5.7.3.2)
msPKI-RA-Signature:       0 (no authorized signature required)

The attacker uses Certify to request a certificate from the PinnacleUserAuth template, specifying the SAN as administrator@pinnacle-defense.example.com — the domain administrator account.

Evidence Artifacts:

Phase 3 — Domain Admin Escalation (~40 min)¶

Using the fraudulently obtained certificate, GOLDEN CIPHER authenticates as the domain administrator via Kerberos PKINIT (certificate-based Kerberos authentication). They use Rubeus to request a TGT using the forged certificate, successfully impersonating administrator@pinnacle-defense.example.com.

With domain admin privileges, the attacker performs systematic internal reconnaissance: enumerating domain trusts, Group Policy Objects, sensitive security groups, and high-value file shares. They identify a file server (FILE-CLASSIFIED, 10.10.2.15) hosting CUI and export-controlled technical data for the AEGIS radar program.

Evidence Artifacts:

SecurityEvent
| where EventID == 4768
| where PreAuthType == "16"  // PKINIT
| extend SourceHost = extract("IpAddress:\\s*(\\S+)", 1, EventData)
| join kind=leftanti (
    DeviceInventory
    | where HasSmartCardReader == true
    | project DeviceIP
) on $left.SourceHost == $right.DeviceIP
| project TimeGenerated, Account, SourceHost, CertificateSerialNumber
| sort by TimeGenerated desc

Event
| where Source == "Microsoft-Windows-CertificationAuthority"
| where EventID == 4887
| extend Requester = extract("Requester:\\s*(.+?)\\s", 1, RenderedDescription)
| extend SAN = extract("Subject Alternative Name.*?=(.+?)\\s", 1, RenderedDescription)
| where Requester !contains extract("(.+?)@", 1, SAN)
| project TimeGenerated, Requester, SAN, CertificateTemplate, SerialNumber

Phase 4 — Golden Certificate Persistence (~50 min)¶

Having achieved domain admin access, GOLDEN CIPHER now targets the ultimate persistence mechanism: the CA server's private key. With domain admin privileges, the attacker accesses PINNACLE-SUB-CA (192.0.2.10) via RDP and exports the CA certificate and private key using certutil.

With the CA private key, the attacker can forge certificates for any user or computer in the domain — indefinitely. This is the "golden certificate" attack. Unlike golden tickets (which are invalidated by double-resetting the krbtgt account), golden certificates persist until the entire CA is rebuilt — the CA certificate and private key cannot be simply "rotated."

Evidence Artifacts:

SecurityEvent
| where Computer contains "CA" or Computer contains "Certificate"
| where EventID == 4688
| where CommandLine has_any ("certutil", "-exportPFX", "-backupKey", "-backup", ".pfx")
| project TimeGenerated, Computer, Account, CommandLine, ParentProcessName
| sort by TimeGenerated desc

SecurityEvent
| where EventID == 4624
| where LogonType == 10  // RemoteInteractive (RDP)
| where Computer in ("PINNACLE-SUB-CA", "PINNACLE-ROOT-CA")
| project TimeGenerated, Account, SourceIP = IpAddress, Computer
| join kind=leftanti (
    SecurityEvent
    | where EventID == 4624 and LogonType == 10
    | where Computer in ("PINNACLE-SUB-CA", "PINNACLE-ROOT-CA")
    | where TimeGenerated between (ago(90d) .. ago(1d))
    | distinct Account
) on Account
| sort by TimeGenerated desc

Phase 5 — Long-Term Persistence and Exfiltration (~30 min)¶

Before the security team detects the breach, GOLDEN CIPHER uses the exfiltrated CA private key to forge certificates for 3 service accounts with minimal monitoring: svc-backup, svc-sql-aegis, and svc-wsus. These forged certificates provide redundant persistent access that will survive password resets, account lockouts, and even krbtgt rotation. The attacker also creates a scheduled task on WKST-ENG-047 that executes a Cobalt Strike beacon via a forged code signing certificate, bypassing application whitelisting.

Over the next 14 days, GOLDEN CIPHER exfiltrates 2.3 GB of classified program data from the AEGIS file share, transmitting data in 50–100 KB increments over the HTTPS C2 channel to 198.51.100.44. The exfiltration occurs during business hours to blend with normal traffic patterns.

Evidence Artifacts:

Detection & Response¶

Key Detection Opportunities¶

// Detect certificate requests where requester != SAN identity (ESC1 exploitation)
SecurityEvent
| where EventID in (4886, 4887)
| extend Requester = extract(@"Requester:\s*(\S+)", 1, EventData)
| extend SAN = extract(@"Subject Alternative Name.*?=(\S+@\S+)", 1, EventData)
| extend Template = extract(@"Certificate Template:\s*(.+?)(\s|$)", 1, EventData)
| where isnotempty(SAN)
| where Requester !has extract(@"(.+?)@", 1, SAN)
| project TimeGenerated, Requester, SAN, Template, Computer
| sort by TimeGenerated desc

Immediate Containment (0–4 hours)¶

• [ ] Revoke the compromised administrator certificate (Serial: 6100000004B3E8C7A2D1)
• [ ] Isolate WKST-ENG-047 and PINNACLE-SUB-CA from the network
• [ ] Block C2 IP 198.51.100.44 at perimeter firewall and proxy
• [ ] Reset administrator, svc-backup, svc-sql-aegis, svc-wsus passwords
• [ ] Disable the PinnacleUserAuth certificate template immediately
• [ ] Force Kerberos ticket invalidation via double krbtgt reset (12-hour interval)
• [ ] Revoke CA certificate via root CA CRL

Short-Term Actions (24–72 hours)¶

• [ ] Forensic imaging of compromised hosts and CA server
• [ ] Audit all 47 certificate templates for ESC1–ESC8 vulnerabilities
• [ ] Review all certificates issued in the past 30 days for SAN anomalies
• [ ] Deploy monitoring for Event IDs 4886, 4887, 4768 with SAN mismatch alerting
• [ ] Implement certutil.exe execution alerting on all CA servers
• [ ] Initiate DFARS 252.204-7012 incident reporting to DCSA

Long-Term Actions (1–12 weeks)¶

• [ ] Rebuild CA hierarchy — new root CA, new subordinate CA, new key pairs
• [ ] Re-issue all user, computer, and service certificates from new CA
• [ ] Harden all certificate templates: remove ENROLLEE_SUPPLIES_SUBJECT, require manager approval, restrict enrollment permissions to specific security groups
• [ ] Deploy AD CS monitoring: PSPKIAudit scheduled scans, Event ID 4886/4887 SIEM correlation
• [ ] Implement PKINIT anomaly detection correlated with hardware inventory
• [ ] Restrict CA server access: PAW-only RDP, tiered admin model, disable remote certutil
• [ ] Deploy certificate transparency logging for internal CA infrastructure
• [ ] Conduct CMMC reassessment focusing on PKI controls

Lessons Learned¶

What Went Wrong¶

What Went Right¶

ATT&CK Navigator Mapping¶

Related Chapters¶

• Chapter 16 — Public Key Infrastructure — Certificate authorities, certificate lifecycle, PKI architecture
• Chapter 17 — Identity and Access Management — Kerberos authentication, PKINIT, credential management
• Chapter 45 — Active Directory Red Teaming — AD CS attacks, ESC1–ESC8, golden certificate techniques