April 26, 2026 at 5:45 PM
Congress ratifies $1.9 billion IMF deal to ease deep economic crisis
➡️ https://l.euronews.com/esC1
➡️ https://l.euronews.com/esC1
September 19, 2026 at 8:42 AM
Congress ratifies $1.9 billion IMF deal to ease deep economic crisis
➡️ https://l.euronews.com/esC1
➡️ https://l.euronews.com/esC1
December 2, 2024 at 6:51 PM
Esc1-mediated anchoring regulates telomere clustering in response to metabolic changes. https://www.biorxiv.org/content/10.64898/2025.12.09.692953v1
December 11, 2025 at 11:32 AM
Esc1-mediated anchoring regulates telomere clustering in response to metabolic changes. https://www.biorxiv.org/content/10.64898/2025.12.09.692953v1
It's been almost a year since my last blog... So, here is a new one: Extending AD CS attack surface to the cloud with Intune certificates.
Also includes ESC1 over Intune (in some cases).
dirkjanm.io/extending-ad...
Oh, and a new tool for SCEP: github.com/dirkjanm/sce...
Also includes ESC1 over Intune (in some cases).
dirkjanm.io/extending-ad...
Oh, and a new tool for SCEP: github.com/dirkjanm/sce...
Extending AD CS attack surface to the cloud with Intune certificates
Active Directory Certificate Services (AD CS) attack surface is pretty well explored in Active Directory itself, with *checks notes* already 16 “ESC” attacks being publicly described. Hybrid attack pa...
dirkjanm.io
July 30, 2025 at 3:46 PM
It's been almost a year since my last blog... So, here is a new one: Extending AD CS attack surface to the cloud with Intune certificates.
Also includes ESC1 over Intune (in some cases).
dirkjanm.io/extending-ad...
Oh, and a new tool for SCEP: github.com/dirkjanm/sce...
Also includes ESC1 over Intune (in some cases).
dirkjanm.io/extending-ad...
Oh, and a new tool for SCEP: github.com/dirkjanm/sce...
Read the Bits, Not the Integer: msPKI-Certificate-Name-Flag and the ESC4⤍ESC1 Chain
SecretMyth · Read the Bits, Not the Integer: msPKI-Certificate-Name-Flag and the ESC4⤍ESC1 Chain
secretmyth.blog
September 11, 2026 at 9:58 AM
Read the Bits, Not the Integer: msPKI-Certificate-Name-Flag and the ESC4⤍ESC1 Chain
🌱🤝 EDITOR'S CHOICE 🤝🌱
ESCAPE 1/PERK13 is a receptor-like kinase that enables Arabidopsis to detect neighboring species through the activation of specific genetic pathways - Libourel et al.
🔗 doi.org/10.1093/jxb/...
#PlantScience 🧪
ESCAPE 1/PERK13 is a receptor-like kinase that enables Arabidopsis to detect neighboring species through the activation of specific genetic pathways - Libourel et al.
🔗 doi.org/10.1093/jxb/...
#PlantScience 🧪
![Fig. 1 (shortened, full legend in paper): ESC1/PERK13 contributes to the escape strategy of Arabidopsis in response to Poa annua. (A) Representative images of Arabidopsis plants growing in the absence or the presence of P. annua. (B) Illustration of the natural variation of height-to-diameter (HD) ratio in two accessions with contrasting phenotypes: low HD ratio on the left and high HD ratio on the right. (C) Detailed view of the association peak identified for HD ratio in response to P. annua in Libourel et al. (2021), with a schematic representation of the genes located in the interval of the QTL identified. The numbered vertical bars represent the position of the T-DNA mutations in the lines used in this study (Supplementary Table S1). The red dots indicate the most significant associated SNPs [–log10(P-value) >4]. The yellow shaded area indicates the confidence interval detected using a local score approach (Bonhomme et al., 2019).](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:ggz22gcwkakll7efac23g33s/bafkreihl2rhezxwtaa7jkv6bmcyzcjiamohxe5gjzha4j2qwx6ojwglfwq)
August 11, 2026 at 10:15 AM
🌱🤝 EDITOR'S CHOICE 🤝🌱
ESCAPE 1/PERK13 is a receptor-like kinase that enables Arabidopsis to detect neighboring species through the activation of specific genetic pathways - Libourel et al.
🔗 doi.org/10.1093/jxb/...
#PlantScience 🧪
ESCAPE 1/PERK13 is a receptor-like kinase that enables Arabidopsis to detect neighboring species through the activation of specific genetic pathways - Libourel et al.
🔗 doi.org/10.1093/jxb/...
#PlantScience 🧪
Second story from a recent coffee break with my pentest colleague. During a retest for a client, they discovered the same ESC1 vulnerability they had reported before. Why is that dangerous and also super critical?
October 18, 2025 at 6:46 AM
Second story from a recent coffee break with my pentest colleague. During a retest for a client, they discovered the same ESC1 vulnerability they had reported before. Why is that dangerous and also super critical?
From vendor to ESC1 medium.com/@Debugger/fr...
From vendor to ESC1
This post isn’t about vendor-bashing. With attacks against Active Directory Certificate Services (ADCS) increasing, I want to show how…
medium.com
November 8, 2025 at 7:31 PM
From vendor to ESC1 medium.com/@Debugger/fr...
JUST IN: NASDAQ FUTURES <NQc1> UP 0.58%, S&P 500 FUTURES <ESc1> UP 0.39%, AS PER REUTERS
X
X
January 2, 2026 at 2:53 AM
JUST IN: NASDAQ FUTURES <NQc1> UP 0.58%, S&P 500 FUTURES <ESc1> UP 0.39%, AS PER REUTERS
X
X
doi.org/10.1083/jcb....
If you want to know more about how genome organization is regulated by environmental cues: Check out our latest article published in Journal of Cell biology.
If you want to know more about how genome organization is regulated by environmental cues: Check out our latest article published in Journal of Cell biology.
Esc1-mediated anchoring regulates telomere clustering in response to metabolic changes
Ruault et al. reveal how budding yeast telomeres reorganize from peripheral foci to a central hypercluster in long-lived quiescent cells. They show that th
doi.org
August 14, 2026 at 4:19 PM
doi.org/10.1083/jcb....
If you want to know more about how genome organization is regulated by environmental cues: Check out our latest article published in Journal of Cell biology.
If you want to know more about how genome organization is regulated by environmental cues: Check out our latest article published in Journal of Cell biology.
ESC1 is a misconfiguration that allows a regular domain user to request a certificate for a Domain Admin and use it to take control of the entire domain.
ESC1 offers a basic and stealthy method for escalating from a compromised user account to a domain compromise." [2]
ESC1 offers a basic and stealthy method for escalating from a compromised user account to a domain compromise." [2]
October 18, 2025 at 6:46 AM
ESC1 is a misconfiguration that allows a regular domain user to request a certificate for a Domain Admin and use it to take control of the entire domain.
ESC1 offers a basic and stealthy method for escalating from a compromised user account to a domain compromise." [2]
ESC1 offers a basic and stealthy method for escalating from a compromised user account to a domain compromise." [2]
Quick tip for creating a bunch of really bad, ugly and misconfigured certificate templates you can use for testing defensive or offensive tools:
Use Tactical Speed Square! Created by the legend Jake Hildreth (https://bsky.app/profile/dotdot.horse )
Create templates vulnerable to ESC1 through ESC5.
Use Tactical Speed Square! Created by the legend Jake Hildreth (https://bsky.app/profile/dotdot.horse )
Create templates vulnerable to ESC1 through ESC5.
Locksmith/Tests/Invoke-TSS.ps1 at main · jakehildreth/Locksmith
A small tool built to find and fix common misconfigurations in Active Directory Certificate Services. - jakehildreth/Locksmith
github.com
February 24, 2025 at 5:31 PM
Quick tip for creating a bunch of really bad, ugly and misconfigured certificate templates you can use for testing defensive or offensive tools:
Use Tactical Speed Square! Created by the legend Jake Hildreth (https://bsky.app/profile/dotdot.horse )
Create templates vulnerable to ESC1 through ESC5.
Use Tactical Speed Square! Created by the legend Jake Hildreth (https://bsky.app/profile/dotdot.horse )
Create templates vulnerable to ESC1 through ESC5.
Have you ever checked your Active Directory Certificate Services environment for possible attack paths?
Check out this blog post detailing ESC1 domain escalation requirements and how BloodHound identifies these attack paths.
posts.specterops.io/adcs-attack-...
#infosec #pentest #redteam #blueteam
Check out this blog post detailing ESC1 domain escalation requirements and how BloodHound identifies these attack paths.
posts.specterops.io/adcs-attack-...
#infosec #pentest #redteam #blueteam
ADCS Attack Paths in BloodHound — Part 1
Since Will Schroeder and Lee Christensen published the Certified Pre-Owned whitepaper, the BloodHound Enterprise team at SpecterOps has…
posts.specterops.io
May 25, 2024 at 7:32 AM
Have you ever checked your Active Directory Certificate Services environment for possible attack paths?
Check out this blog post detailing ESC1 domain escalation requirements and how BloodHound identifies these attack paths.
posts.specterops.io/adcs-attack-...
#infosec #pentest #redteam #blueteam
Check out this blog post detailing ESC1 domain escalation requirements and how BloodHound identifies these attack paths.
posts.specterops.io/adcs-attack-...
#infosec #pentest #redteam #blueteam
O PROBLEMA DO AGRONEGÓCIO BRASILEIRO
#agronegocio #agro #agronegociobrasil #Mst #MSTemLuta #TMST #agriculturafamiliar
www.youtube.com/watch?v=ESc1...
#agronegocio #agro #agronegociobrasil #Mst #MSTemLuta #TMST #agriculturafamiliar
www.youtube.com/watch?v=ESc1...
O PROBLEMA DO AGRONEGÓCIO BRASILEIRO
YouTube video by Raul Ferreira Netto Sem Limites
www.youtube.com
April 29, 2025 at 4:55 PM
O PROBLEMA DO AGRONEGÓCIO BRASILEIRO
#agronegocio #agro #agronegociobrasil #Mst #MSTemLuta #TMST #agriculturafamiliar
www.youtube.com/watch?v=ESc1...
#agronegocio #agro #agronegociobrasil #Mst #MSTemLuta #TMST #agriculturafamiliar
www.youtube.com/watch?v=ESc1...
One of the most common and impactful of these is ESC1, short for "Domain Escalation Scenario 1," first outlined in the Certified Pre-Owned whitepaper by Will Schroeder and Lee Christensen. [1]
October 18, 2025 at 6:46 AM
One of the most common and impactful of these is ESC1, short for "Domain Escalation Scenario 1," first outlined in the Certified Pre-Owned whitepaper by Will Schroeder and Lee Christensen. [1]
Saw a client that had actually tightened enrolment of vulnerable ADCS cert templates this week.
Found service account creds in SCCM distribution point shares, which then opened up ADCS ESC1 to auth my way to DA.
Found service account creds in SCCM distribution point shares, which then opened up ADCS ESC1 to auth my way to DA.
February 22, 2025 at 12:28 AM
Saw a client that had actually tightened enrolment of vulnerable ADCS cert templates this week.
Found service account creds in SCCM distribution point shares, which then opened up ADCS ESC1 to auth my way to DA.
Found service account creds in SCCM distribution point shares, which then opened up ADCS ESC1 to auth my way to DA.
Is it possible to configure a certificate template for Client Authentication in SCEP for Intune using "Build from this Active Directory" instead of enabling "Supply in the request"? I'm asking this due the ESC1 Defender recommendation.
#MSIntune #Intune #MicrosoftSecurity #Security #DefenderXDR
#MSIntune #Intune #MicrosoftSecurity #Security #DefenderXDR
December 11, 2024 at 10:45 AM
Is it possible to configure a certificate template for Client Authentication in SCEP for Intune using "Build from this Active Directory" instead of enabling "Supply in the request"? I'm asking this due the ESC1 Defender recommendation.
#MSIntune #Intune #MicrosoftSecurity #Security #DefenderXDR
#MSIntune #Intune #MicrosoftSecurity #Security #DefenderXDR
The origin of critical misconfigurations may be a trusted vendor of yours.
@martinsohn.dk’s latest research found official documentation across 16 vendors introducing critical attack paths, often through AD CS misconfigurations.
Check it out: https://ghst.ly/4bwYiBe
@martinsohn.dk’s latest research found official documentation across 16 vendors introducing critical attack paths, often through AD CS misconfigurations.
Check it out: https://ghst.ly/4bwYiBe
RTFM: Read The Fatal Manual - When Vendor Documentation Creates Critical Attack Paths - SpecterOps
How major tech companies' docs guide users to deploy critical misconfigurations, often AD CS ESC1. Responsible disclosure findings, process, timeline.
ghst.ly
March 24, 2026 at 6:51 PM
The origin of critical misconfigurations may be a trusted vendor of yours.
@martinsohn.dk’s latest research found official documentation across 16 vendors introducing critical attack paths, often through AD CS misconfigurations.
Check it out: https://ghst.ly/4bwYiBe
@martinsohn.dk’s latest research found official documentation across 16 vendors introducing critical attack paths, often through AD CS misconfigurations.
Check it out: https://ghst.ly/4bwYiBe
Exploiting authority from HackTheBox involves cracking Ansible vault, messing with PWM, and two really neat twists on the ESC1 ADCS attack, where I'll generate and use a fake computer, and use Pass-The-Cert.
0xdf.gitlab.io/2023/12/09/h...
0xdf.gitlab.io/2023/12/09/h...
HTB: Authority
Authority is a Windows domain controller. I’ll access open shares over SMB to find some Ansible playbooks. I’ll crack some encrypted fields to get credentials for a PWM instance. The PWM instance ...
0xdf.gitlab.io
December 9, 2023 at 2:58 PM
Exploiting authority from HackTheBox involves cracking Ansible vault, messing with PWM, and two really neat twists on the ESC1 ADCS attack, where I'll generate and use a fake computer, and use Pass-The-Cert.
0xdf.gitlab.io/2023/12/09/h...
0xdf.gitlab.io/2023/12/09/h...
Shibuya is another vulnlab_eu release on HackTheBox. This is a hard Windows box with many steps, including RemotePotato0, Firewall enumeration, ESC1, and a cross-session relay attack.
HTB: Shibuya
Shibuya starts with a brute force user enumeration over Kerberos, finding two machine accounts with their passwords set to their username. I’ll use those to enumerate LDAP, finding credentials for a service account in a comment. That user has access to an SMB share with three Windows Imaging images, and one contains backups of the registry hives. I’ll dump hashes from these, and spray them to get access to another user and a shell. There’s another user logged into the box, and I’ll use RemotePotato0 to get a shell with a cross session relay attack. This user can exploit ESC1 in the ADCS configuration to get administrator access.
0xdf.gitlab.io
June 19, 2025 at 1:59 PM
Shibuya is another vulnlab_eu release on HackTheBox. This is a hard Windows box with many steps, including RemotePotato0, Firewall enumeration, ESC1, and a cross-session relay attack.
AD CS Certificate Health Report: Find CRL, Expiry and ESC1 Risk Before Your PKI Does
https://techygeekshome.info/ad-cs-certificate-health-report-announcement/
https://techygeekshome.info/ad-cs-certificate-health-report-announcement/
September 18, 2026 at 10:05 PM
AD CS Certificate Health Report: Find CRL, Expiry and ESC1 Risk Before Your PKI Does
https://techygeekshome.info/ad-cs-certificate-health-report-announcement/
https://techygeekshome.info/ad-cs-certificate-health-report-announcement/