AD CS decoy
The AD CS decoy is a certificate template that attack tools report as exploitable, but which your certificate authority never issues. Tools that report it include Certipy, Certify and BloodHound. Abusing certificate templates (ESC1 and similar) is one of the most common ways attackers escalate privileges in Active Directory. Nobody has a legitimate reason to request a certificate from the decoy, so a request for it is a strong sign that someone is attacking your domain. A scheduled task on the CA reports every request for the decoy to a custom honeypot. The alert shows the account that asked and who it tried to become. [!NOTE] The AD CS decoy is in beta. Whether you can use it depends on your plan: it's included with custom honeypots in the Professional plan and higher (see Subscription). It's built on Certily (MIT licence). How it works The template looks exploitable: for example, any domain user may enroll, choose the name on the certificate, and use it to log in. A real protection is switched on, and it's hidden from domain users: An authorised signature is required. The signature must also carry an issuance policy that no certificate has, so nobody can provide it. The protection is hidden from Domain Users. Attack tools running as a user can't read these settings, so they report the template as vulnerable. The CA reads the real settings and refuses every request. Every 5 minutes, the task on the CA: Reports requests. It sends every request for the decoy as a critical event, including those the CA refused. Clears up. It denies any request left pending. If a certificate was ever issued from the decoy (it shouldn't be), it revokes it at once. Checks the protection. If someone removes the decoy's protection, the task takes the decoy offline and alerts you. A decoy without its protection would be a real vulnerability. Sends a heartbeat. You're alerted if the task stops for 30 minutes. Before you start You need: An Enterprise CA on Windows Server. No CA yet? The installer can make one, see No certificate authority yet. The PowerShell modules it needs (RSAT-AD-PowerShell and RSAT-ADCS-Mgmt) are installed if missing. An Enterprise Admin account, used once to create the template. The task runs as SYSTEM. HTTPS access from the CA to your OrbitalCyber address. Tell your PKI team about the decoy, so nobody "fixes" or deletes it. Set up the decoy Go to Honeypots > Custom and, under AD CS decoy, select Set up an AD CS decoy. Enter a Template name that looks like your real templates (for example VPN-Users-Legacy). Choose What it looks vulnerable to: ESC1 (recommended): anyone can request a logon certificate for any user. ESC2: an "Any Purpose" certificate. ESC3: an enrollment agent. These are rare in real environments. ESC9: no security extension. ESC17: server authentication with a chosen name. Select Create and download the config file. Your browser downloads orbital-adcs-decoy.json, which holds the custom honeypot's token. It isn't shown again. Select Download the signed installer and unzip it on the CA, next to the config file. On the CA, open Windows PowerShell as administrator, signed in as an Enterprise Admin. In that folder, run the command the page shows: Confirm when asked. If the CA doesn't log certificate requests yet, the installer turns that on, which restarts the CA service for a few seconds. It asks first. Delete orbital-adcs-decoy.json. The installed copy of the token is encrypted for that machine. When it's done, a decoy armed event appears on the Honeypots > Activity tab. The custom honeypot then shows a heartbeat every 5 minutes. If the page says the installer isn't available yet, it arrives with the next OrbitalCyber release. No certificate authority yet If your domain has no certificate authority, or you'd rather keep the decoy off your production CA, run the installer on a domain-joined Windows Server and add -InstallCA: It installs Active Directory Certificate Services and registers the server as an Enterprise CA…
OrbitalCyber documentation