---
id: 5795
title: "ESC1 Attack Explained"
source_domain: semperis.com
source_url: "https://www.semperis.com/blog/esc1-attack-explained/"
published_at: "2025-05-01T13:29:00Z"
tags: ["active-directory", "privilege-escalation", "vulnerability", "defense", "ad-cs", "esc1", "certificate-templates"]
phying_url: "https://phying.com/item/5795"
lang: en
---

# ESC1 Attack Explained

## Summary

ESC1 abuses AD CS certificate templates with requester-supplied subject names and client-auth EKUs, letting an attacker get a certificate for any account, such as Domain Admin.

## Intelligence Metadata

- **Sources:** semperis.com
- **Published:** 2025-05-01T13:29:00Z
- **Original:** https://www.semperis.com/blog/esc1-attack-explained/
- **Phying News:** https://phying.com/item/5795