ADTRADE-009: Cert Publishers Group Membership
- Platform
- Active Directory
- Category
- AD Adversary Tradecraft Indicators
- Severity
- High
- Zero Trust pillar
- Identity (weight 2)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Members of the Cert Publishers group (domain RID 517) are permitted to publish certificates to the NTAuth store and to user/computer objects. By default the group contains only the Enterprise CA computer account(s). A user or service account placed in this group gains the ability to influence which certificates are trusted for authentication, which is a stepping stone in several AD CS escalation paths (ESC-class attacks) and can enable certificate-based impersonation. Computer-account membership (the CA hosts themselves) is expected; any non-computer member is a finding.
Recommended value
Cert Publishers contains only the Enterprise CA computer account(s) — no user or service accounts.
Remediation
Remove any user or service account from the Cert Publishers group; only Enterprise CA computer accounts belong there. Review NTAuth store contents (certutil -viewstore -enterprise NTAuth) for unexpected CA certificates. Harden AD CS broadly: audit certificate template enrollment permissions and the ESC1-ESC8 misconfiguration surface.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-data | Not Assessed |
Framework mappings
- NIST SP 800-53
- AC-6, IA-5
- ANSSI
- vuln1_adcs_cert_publishers
- CIS AD Benchmark
- 6.4.1
- MITRE ATT&CK
- T1649, T1556.004