Threat intel,
translated.

Active Directory Certificate Services (ADCS) has been a staple of Windows environments for decades. For most IT teams, it quietly issues certificates and stays out of the way. For attackers, it's a skeleton key.

What's the actual problem?

ADCS misconfigurations — categorized as ESC1 through ESC15 — let attackers request certificates that impersonate privileged accounts. ESC1, the most common, allows any domain user to enroll in a certificate template and request a cert as a domain admin. No exploit. No special tool. Just a misconfigured template that's been sitting there since the server was stood up.

ESC8 is worse

ESC8 combines NTLM relay with ADCS. An attacker coerces a domain controller into authenticating to them, relays that auth to the ADCS HTTP enrollment endpoint, and gets a certificate for the DC's machine account. From there, it's a straight line to DCSync and full domain takeover.

What to check right now

• Run Certify or Certipy against your ADCS environment and look for ESC1–ESC8 findings
• Audit certificate templates — anything with "Enrollee Supplies Subject" enabled is a red flag
• Disable HTTP enrollment on ADCS if you don't need it (kills ESC8 relay path)
• Enable EPA (Extended Protection for Authentication) on IIS

NTLM is a Windows authentication protocol from the early 90s. Microsoft has been trying to deprecate it for years. And yet in most SMB Active Directory environments, it's still running — and still being exploited.

How relay attacks work

When a Windows machine tries to authenticate to a network resource, it sends an NTLM authentication challenge. An attacker can intercept that challenge and relay it to a different service — impersonating the victim machine without ever cracking a password.

Why credit unions are exposed

• Legacy line-of-business software often requires NTLM — disabling it breaks things
• Flat network architectures mean an attacker on any VLAN can relay freely
• SMB signing is frequently disabled on file servers for "performance reasons"
• LDAP signing and channel binding are often not enforced on domain controllers

The three-step fix

Enable SMB signing across all domain-joined machines, enforce LDAP signing and channel binding on your DCs, and block outbound NTLM to external hosts at the firewall. That alone removes most relay paths without breaking legacy apps.

Ransomware operators are not running zero-days against SMBs. They're running the same repeatable playbook, over and over, because it works. Here's the chain — and where you can break it.

Step 1: Initial access

Phishing is still the most common entry point. One credential, one VPN account without MFA, one RDP endpoint exposed to the internet. That's all it takes to get a foothold as a low-privileged domain user.

Step 2: Internal recon

Once inside, attackers run BloodHound to map the domain. They're looking for Kerberoastable service accounts with weak passwords, users with unconstrained delegation, and paths to privileged groups.

Step 3 → Domain admin

They crack the Kerberoasted hash offline. Or they find an ESC1 misconfiguration. Or they relay NTLM to a DC. There are a dozen paths — they only need one.

Where to break the chain

• MFA on VPN and remote access kills most initial access vectors
• Tiered admin model limits blast radius if a low-priv account is compromised
• Offline, air-gapped backups survive domain-wide encryption
• Regular AD assessments catch the escalation paths before attackers do

NCUA's cybersecurity examination program has matured significantly. Examiners aren't just checking if you have a firewall and an incident response plan anymore. They want evidence that your controls actually work.

What's getting flagged

• Lack of documented penetration testing — and no evidence of remediation
• No privileged access management strategy (shared admin accounts are still everywhere)
• Weak MFA implementation — SMS-based MFA no longer satisfies many field offices
• Inability to demonstrate network segmentation in practice, not just on paper

How a pentest helps

A scoped penetration test — especially one that maps findings to NCUA's cybersecurity maturity framework — gives you a documented artifact that shows examiners you're proactively testing your controls. Our reports are structured to be examiner-friendly by design.