Detecting ADCS Privilege Escalation

This blog explains how misconfigurations in Active Directory Certificate Services (ADCS) can enable privilege escalation (e.g., ESC1) by allowing low-privileged accounts to request certificates for privileged users, and it provides step-by-step guidance to enable ADCS auditing and build Microsoft Sentinel detections (KQL queries, alert rules) for relevant event IDs and behaviors.