ADCS.ESC.Assessment
0.1.0
Read-only security assessment for AD CS ESC1-ESC16 misconfigurations. Non-destructive.
Minimum PowerShell version
5.1
Installation Options
Owners
Copyright
(c) 2026 Mustafa Emre GUL. All rights reserved.
Package Details
Author(s)
- Mustafa Emre GUL
Tags
ADCS Security ESC Certificate Audit BlueTeam PKI ActiveDirectory
Functions
Invoke-ESCAssessment Export-EscCaData
PSEditions
Dependencies
This module has no dependencies.
Release Notes
v0.1.0 - Initial release (2026)
ADCS.ESC.Assessment is a read-only, non-destructive security assessment for
Active Directory Certificate Services (AD CS). It evaluates an environment
against the ESC1-ESC16 privilege-escalation misconfigurations, scores each
finding, and produces a self-contained HTML report plus machine-readable JSON.
Highlights
- Coverage for ESC1 through ESC16 (enrollee-supplied SAN, Any-Purpose EKU,
enrollment agent, template/PKI/CA ACLs, EDITF_ATTRIBUTESUBJECTALTNAME2,
ManageCA, web-enrollment NTLM relay, missing security extension, weak/explicit
mappings, ICertPassage RPC encryption, HSM/shell access, OID group link,
altSecurityIdentities, and EKUwu / CVE-2024-49019).
- Risk scoring (0-10 per finding) and an overall posture score (0-100 with an
A-F grade).
- Live collection on Windows (RSAT ActiveDirectory preferred, DirectoryServices
fallback) and an offline, fixture-based mode that runs on any platform (pwsh 7).
- Optional live-only CA extras: registry + issued-cert export (-ExportCaData),
full read-only CA backup (-BackupCa), and unused-template analysis
(-AnalyzeTemplateUsage).
- Exports two commands: Invoke-ESCAssessment and Export-EscCaData.
Safety
Read-only and non-destructive by design. No certificate is requested, issued,
or submitted, and no AD/CA object is modified. Permitted operations are limited
to LDAP search, certutil -getreg (read), registry reads, and HTTP GET/HEAD for
endpoint detection. Run only against environments you own or are authorized to test.
See docs/Invoke-ESCAssessment.md and docs/Export-EscCaData.md for full usage.
FileList
- ADCS.ESC.Assessment.nuspec
- ADCS.ESC.Assessment.psd1
- ADCS.ESC.Assessment.psm1
- Analyzers\Test-Esc1.ps1
- Analyzers\Test-Esc10.ps1
- Analyzers\Test-Esc11.ps1
- Analyzers\Test-Esc12.ps1
- Analyzers\Test-Esc13.ps1
- Analyzers\Test-Esc14.ps1
- Analyzers\Test-Esc15.ps1
- Analyzers\Test-Esc16.ps1
- Analyzers\Test-Esc2.ps1
- Analyzers\Test-Esc3.ps1
- Analyzers\Test-Esc4.ps1
- Analyzers\Test-Esc5.ps1
- Analyzers\Test-Esc6.ps1
- Analyzers\Test-Esc7.ps1
- Analyzers\Test-Esc8.ps1
- Analyzers\Test-Esc9.ps1
- Collectors\Get-EscAltSecurityIdentity.ps1
- Collectors\Get-EscCaConfiguration.ps1
- Collectors\Get-EscCaServerStatus.ps1
- Collectors\Get-EscCertPublisher.ps1
- Collectors\Get-EscCertificateTemplate.ps1
- Collectors\Get-EscDomainMapping.ps1
- Collectors\Get-EscEnrollmentService.ps1
- Collectors\Get-EscOidGroupLink.ps1
- Collectors\Get-EscPkiObjectAcl.ps1
- Collectors\Get-EscUnusedPublishedTemplate.ps1
- Collectors\Get-EscWebEnrollmentEndpoint.ps1
- Private\ConvertFrom-CertutilRegistry.ps1
- Private\ConvertFrom-SecurityDescriptor.ps1
- Private\ConvertTo-EscCaConfigObject.ps1
- Private\ConvertTo-EscPkiAclObject.ps1
- Private\ConvertTo-EscPropertyBag.ps1
- Private\ConvertTo-EscRegistryDump.ps1
- Private\ConvertTo-EscTemplateObject.ps1
- Private\Export-EscCrlList.ps1
- Private\Get-EscCaRoleAssignment.ps1
- Private\Get-EscDirectoryContext.ps1
- Private\Protect-EscBackupFolder.ps1
- Private\Resolve-LowPrivPrincipal.ps1
- Private\Test-EscEkuAllowsAuth.ps1
- Private\Test-EscTcpPort.ps1
- Private\Write-EscLog.ps1
- Public\Invoke-ESCAssessment.ps1
- Reporting\Export-EscCaData.ps1
- Reporting\Export-EscHtmlReport.ps1
- Reporting\Export-EscJsonReport.ps1
- Scoring\Get-EscPostureScore.ps1
- Scoring\Get-EscRiskScore.ps1
Version History
| Version | Downloads | Last updated |
|---|---|---|
| 0.1.0 (current version) | 7 | 8/28/2026 |