Product

Active Directory Certificate Services

0 mentions in 7 days · 2 in 30 days · 2 total · first seen Aug 26, 2026 · last 15d ago

Timeline2 articles

Privilege escalation from IIS AppPool to NT Authority/SYSTEM

A write-up demonstrates privilege escalation from an IIS AppPool identity to NT AUTHORITY/SYSTEM via the AD CS RPC endpoint.

A technical write-up details a Windows privilege escalation path that moves an IIS application pool identity to NT AUTHORITY/SYSTEM by abusing the Active Directory Certificate Services RPC endpoint. The technique chains the restricted IIS AppPool service context with AD CS access to reach SYSTEM on the host. The post is relevant for defenders mapping privilege escalation paths on Windows web servers.

Lobsters · securityAug 31, 12:36 UTC · 15d agoResearch

CISA Red Team Fully Compromised Two Critical Infrastructure Orgs

CISA red teams achieved full domain and cloud compromise at two critical infrastructure orgs; one SOC never detected the intrusion.

CISA advisory AA26-237A documents two simultaneous red team assessments. Organization A (Government Services sector) missed the intrusion entirely, as default credentials on a web app, ADCS ESC1 abuse, and thousands of false-positive alerts let the red team reach sensitive business systems and read SOC email. Organization B (Water/Wastewater sector) detected, isolated, and reimaged hosts quickly, but both orgs lacked Conditional Access for workload identities, and B still exposed DCSync, Golden Ticket, and OT network attack paths.

Security AffairsAug 26, 23:20 UTC · 20d agoAdvisory1

Appears with

vendor Microsoft 2 organization CISA 1 product Internet Information Services 1 product Microsoft Graph 1 product SCCM 1 victim Organization A 1 threat actor CISA Red Team 1 victim Organization B 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.