ADCS Attack Paths in BloodHound — Part 2

ADCS Attack Paths in BloodHound — Part 2

In Part 1 of this series, we explained how we incorporated Active Directory Certificate Services (ADCS) objects into BloodHound and demonstrated how to effectively use BloodHound to identify attack paths including the ESC1 abuse technique.

In this blog post, we will continue to explore more of the new edges we have introduced with ADCS support in BloodHound. More specifically, we will cover how we have incorporated the Golden Certificate and the ESC3 …

adcs article attack attack paths bloodhound link may posts specterops team topic