ADCS-018: CA Auditing Configuration
- Platform
- Active Directory
- Category
- AD Certificate Services
- Severity
- High
- Zero Trust pillar
- Identity (weight 2)
- Golden fixtures
- 2
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
For every Enterprise CA published under CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration in the forest, the check reads the CA-level AuditFilter DWORD from: HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA-Name>\AuditFilter This mirrors certutil -config "<CA-Host>\<CA-Name>" -getreg CA\AuditFilter. The value is a bitmask of seven flags defined by Microsoft: 0x01 Start and stop Active Directory Certificate Services 0x02 Back up and restore the CA database 0x04 Issue and manage certificate requests 0x08 Revoke certificates and publish CRLs 0x10 Change CA security settings 0x20 Store and retrieve archived keys 0x40 Change CA configuration A fully audited CA reports 127 (0x7F). The check also verifies that Object Access auditing is enabled at the host level (auditpol /get /subcategory:"Certification Services") because the AuditFilter is gated by that subcategory, and confirms that the Security event log MaxSize and Retention policy on the CA host are sufficient to hold the audit volume (default 20 MB rolling logs typically lose CA events within hours on a busy issuing CA). Any CA where AuditFilter is less than 127, where the Certification Services audit subcategory is not set to Success and Failure, or where the Security log is sized below 1 GB with a circular retention policy is reported as a finding.
Why it matters
AD CS is the primary credential persistence and lateral movement primitive in the post-2021 threat landscape. The Certified Pre-Owned research (SpecterOps, 2021) catalogued ESC1 through ESC8, and subsequent work has extended that list through ESC16. Every published technique generates evidence at the CA: a certificate request, an issuance decision, sometimes a key archival operation, and frequently a SAN that does not match the requester. Without complete CA auditing, none of that evidence is preserved. The four most common gaps observed in production environments are (1) "Issue and manage certificate requests" disabled, which suppresses event 4887 / 4886 and hides ESC1, ESC6, and ESC8 exploitation; (2) "Change CA security settings" disabled, which hides an attacker granting themselves Manage CA or Issue and Manage Certificates rights (ESC7); (3) "Change CA configuration" disabled, which hides an attacker toggling EDITF_ATTRIBUTESUBJECTALTNAME2 (ESC6) or disabling the SID security extension; and (4) Security log retention set to Overwrite as needed with a 20 MB cap, which rolls CA events within minutes on a busy CA and erases the evidence even when AuditFilter is correct. Adversaries who reach SYSTEM on a CA host (a common Tier 0 pivot) routinely clear AuditFilter, restart CertSvc, perform their issuance, and restore the prior value, because changes to AuditFilter do not themselves emit a meaningful event unless category 0x10 is already on. The blast radius of incomplete CA auditing is therefore the inability to detect or attribute any certificate-based domain takeover.
Attack path
1. Reach the CA host. The attacker compromises a Tier 0 asset that can administer the CA (Enterprise Admin, Domain Admin on the forest root, or local admin on the CA computer via a misconfigured service account or ESC7 / ADCS-016). 2. Inspect current auditing posture. certutil -getreg CA\AuditFilter on the CA host reveals the bitmask. A finding of less than 127 means certain operations are already invisible; the attacker maps gaps to attack primitives (for example AuditFilter = 3 means only Start/Stop and Backup are logged, leaving issuance and security changes silent). 3. Optionally suppress remaining logging. If the attacker controls the CA host they can set certutil -setreg CA\AuditFilter 3 (or 0), restart CertSvc, then perform the malicious operation, then restore the prior value. Because the Certification Services audit subcategory does not log changes to AuditFilter itself unless 0x40 is asserted, this rollback is invisible if 0x40 was already off. 4. Execute the certificate-based attack. With auditing suppressed the attacker performs ESC1 / ESC6 / ESC8 / ESC15 issuance, ESC7 role assignment, or key archival theft (T1649). Without category 0x04 (Issue and manage certificate requests) set, the issued certificate appears in the CA database (which is not security-audited) but emits no 4886 / 4887 / 4888 event to the Security log, so SIEM correlation by Subject UPN versus requester UPN is not possible. 5. Persist. Certificates issued during the audit gap remain valid for their full lifetime (often 1 to 5 years) and survive password resets, krbtgt rotations, and Tier 0 password changes. UnPAC-the-hash converts the certificate into the targets NT hash for downstream Pass-the-Hash and Kerberos abuse. 6. Restore auditing. The attacker reverts AuditFilter to its prior value and restarts CertSvc. Defenders performing a periodic configuration audit will see normal logging in place. Forensic reconstruction of the issuance is limited to the CA database (certutil -view), which the attacker can also tamper with given SYSTEM on the CA.
How Guerrilla assesses it
Guerrilla enumerates Enterprise CAs by querying the forest configuration NC with LDAP filter (objectClass=pKIEnrollmentService) under CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration,DC=... and extracts dNSHostName and CN for each. For every CA it then performs four reads: - certutil.exe -config "<dNSHostName>\<CA-Name>" -getreg CA\AuditFilter to retrieve the AuditFilter DWORD over MS-WCCE / MS-RRP. - certutil.exe -config "<dNSHostName>\<CA-Name>" -getreg CA\InterfaceFlags to confirm IF_ENABLEADMINASAUDITOR and related flags are coherent with the audit posture. - Remote registry / WMI read against the CA host for HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Security to capture MaxSize and Retention. - A targeted auditpol query (auditpol /get /subcategory:"Certification Services" via Invoke-Command where remoting is available) to confirm the host-level Object Access subcategory is on; without this subcategory the AuditFilter bitmask has no effect. For each CA the check emits the resolved AuditFilter hex value, the decoded list of enabled and missing categories, the Security log MaxSize and Retention policy, the auditpol state, and the CertSvc service last start time (because AuditFilter changes only take effect after CertSvc restart). A CA passes only when AuditFilter == 127, Certification Services Object Access auditing is Success and Failure, Security log MaxSize is at least 1 GB, and Retention is not Overwrite as needed at a size that would roll within 24 hours.
Recommended value
All CA audit categories enabled: Start/Stop, Backup/Restore, Certificate Issued, Certificate Revoked, Certificate Request, CA Security, CA Configuration Change
Remediation
Configure CA auditing using certsrv.msc > CA Properties > Auditing tab. Enable all audit categories: Back up and restore the CA database, Change CA configuration, Change CA security settings, Issue and manage certificate requests, Revoke certificates and publish CRLs, Store and retrieve archived keys, Start and stop AD CS. Verify that the Windows Security event log has sufficient size and retention settings.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| limitation | WARN |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- AU-2, AU-3, AU-12
- MITRE ATT&CK
- T1649, T1562.002