Detecting Active Directory Certificate Services Abuse with Cortex XDR™

Active Directory Certificate Services (AD CS) is a Microsoft server role which implements a public key infrastructure (PKI). It is used to manage and establish trust between different directory objects using digital certificates and digital signatures.

In June 2021, Will Schroeder and Lee Christensen released a white paper named Certified Pre-Owned about research conducted on AD CS. The paper demonst...