Metasploit AD CS Web Enrollment Module: Detecting Certificate Abuse and Infrastructure Exploitation

---
title: Potential AD CS Web Enrollment Abuse via Metasploit
id: a1b2c3d4-5678-4980-8a1b-2c3d4e5f6789
status: experimental
description: Detects potential exploitation of AD CS Web Enrollment interface characterized by specific HTTP POST patterns and the presence of Metasploit user agents or suspicious certificate request parameters.
references:
  - https://attack.mitre.org/techniques/T1649/
  - https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-04-10-2026
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.credential_access
  - attack.t1649
  - attack.initial_access
logsource:
  category: web
  product: iis
detection:
  selection:
    cs_method: 'POST'
    cs_uri_stem|contains:
      - '/certsrv/certfnsh.asp'
      - '/certsrv/certnew.cer'
      - '/certenroll/'
  filter_legit:
    cs_user_agent|contains:
      - 'Microsoft-CryptoAPI'
      - 'Mozilla'
  condition: selection and not filter_legit
falsepositives:
  - Legacy clients or custom enrollment scripts
level: high
---
title: Cisco SD-WAN Controller Command Injection Attempt
id: b2c3d4e5-6789-4080-9b2c-3d4e5f6a7890
status: experimental
description: Detects potential command injection attempts against Cisco SD-WAN vManage interfaces, often exploited by Metasploit modules targeting API endpoints.
references:
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1190
logsource:
  category: web
  product: cisco
detection:
  selection_uri:
    cs_uri_path|contains:
      - '/dataservice/'
      - '/j_security_check'
  selection_payload:
    cs_uri_query|contains:
      - ';'
      - '|'
      - '&&'
      - '`'
  condition: selection_uri and selection_payload
falsepositives:
  - Misconfigured monitoring probes (rare)
level: critical

// Hunt for AD CS Web Enrollment anomalies on the CA Server or Web Proxy
SecurityEvent
| where EventID in (4768, 4769, 4886, 4887)
| where ServiceName contains "CERT"
| project TimeGenerated, Computer, TargetUserName, ServiceName, Status
| join kind=inner (
    Syslog 
    | where Facility contains "local" 
    | where ProcessName contains "nginx" or ProcessName contains "httpd" 
    | parse Message with * "POST " RequestPath " " * 
    | where RequestPath contains "/certsrv/" or RequestPath contains "/certenroll/"
) on $left.Computer == $right.Computer
| summarize count() by bin(TimeGenerated, 5m), Computer, TargetUserName, RequestPath
;

// Hunt for Cisco SD-WAN exploitation indicators in CEF/Syslog
CommonSecurityLog
| where DeviceVendor == "Cisco" 
| where DeviceProduct == "Catalyst" or DeviceProduct contains "SD-WAN"
| where RequestURL contains "/dataservice/" or RequestURL contains "/j_security_check"
| where RequestContext contains ";" or RequestContext contains "|" or RequestContext contains "&&"
| project TimeGenerated, DeviceAddress, SourceIP, RequestURL, RequestMethod, RequestContext
| sort by TimeGenerated desc

-- Hunt for processes spawned by Metasploit or related to AD CS abuse
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ "msfvenom" 
   OR Name =~ "meterpreter" 
   OR Name =~ "powershell.exe" AND CommandLine =~ "certutil"
   OR Name =~ "rundll32.exe" AND CommandLine =~ "pkinit";

-- Hunt for suspicious service creation (S4U Persistence)
SELECT Name, DisplayName, BinaryPath, StartType, ServiceType, Modified
FROM win_service_get()
WHERE DisplayName =~ "service-for-user" 
   OR BinaryPath =~ "powershell" 
   AND Modified > now() - 7d

# Audit AD CS Templates for Web Enrollment Misconfigurations
Write-Host "[*] Initiating AD CS Security Audit..." -ForegroundColor Cyan

# Check for ADCS Deployment
try {
    $CAInfo = Get-ADObject -Filter "objectClass -eq 'pKIEnrollmentService'" -Property * -ErrorAction Stop
    if (-not $CAInfo) {
        Write-Host "[!] No Active Directory Certificate Services found." -ForegroundColor Yellow
        exit
    }
    Write-Host "[+] Found CA: $($CAInfo.Name)" -ForegroundColor Green
} catch {
    Write-Host "[!] Error querying AD for CA: $_" -ForegroundColor Red
    exit
}

# Identify Vulnerable Templates (ESC1/ESC8 logic)
$VulnerableTemplates = @()
$Templates = Get-CATemplate | Where-Object { $_.Property -notlike "*ENROLLEE_SUPPLIES_SUBJECT*" } # Simplified check

foreach ($Template in $Templates) {
    # Check if template allows 'Authenticated Users' to enroll
    $acl = (Get-Acl "AD:\CN=$($Template.Name),CN=Certificate Templates,CN=Public Key Services,CN=Services,$((Get-ADRootDSE).configurationNamingContext)").Access
    $EnrollRights = $acl | Where-Object { $_.IdentityReference -eq "Authenticated Users" -and $_.AccessControlType -eq "Allow" -and $_.ObjectType -eq "0e10c968-78fb-11d2-90d4-00c04f79dc55" } # Enroll GUID

    if ($EnrollRights) {
        Write-Host "[!] VULNERABLE: Template '$($Template.Name)' allows 'Authenticated Users' to enroll." -ForegroundColor Red
        $VulnerableTemplates += $Template.Name
    }
}

if ($VulnerableTemplates.Count -eq 0) {
    Write-Host "[+] No high-risk misconfigurations detected in common templates." -ForegroundColor Green
} else {
    Write-Host "[!] Remediation Required for: $($VulnerableTemplates -join ', ')" -ForegroundColor Red
    Write-Host "    Action: Remove 'Authenticated Users' from Enrollment ACLs or disable the template." -ForegroundColor White
}