Skill UI

This skill guides the deployment and implementation of Breach and Attack Simulation (BAS) platforms. It provides a continuous, automated method to validate security control effectiveness against real-world attacker techniques mapped to the MITRE ATT&CK framework. Use this when moving beyond traditional point-in-time penetration testing to establish continuous control validation and automated adversary emulation across the entire IT environment.

This technique exploits vulnerable Active Directory Certificate Services (AD CS) HTTP web-enrollment endpoints (ESC8) that lack Extended Protection for Authentication (EPA). By coercing a Domain Controller (DC) to authenticate and relaying the captured NTLM credentials, an attacker can obtain a DC machine certificate. This certificate is then used via PKINIT to request a TGT, recover the DC's NT hash, and ultimately achieve full domain compromise via DCSync. Essential for advanced AD red-teaming simulations.