---
id: 7458
title: "ESC8 Attack Guide for Windows Environments"
source_domain: blog.sentry.security
source_url: "https://blog.sentry.security/esc8-attack-guide-for-windows-environments-2/"
published_at: "2025-01-30T12:05:58Z"
tags: ["active-directory", "red-team", "mitigation", "adcs", "esc8", "ntlm-relay", "web-enrollment"]
phying_url: "https://phying.com/item/7458"
lang: en
---

# ESC8 Attack Guide for Windows Environments

## Summary

The ESC8 attack abuses AD CS Web Enrollment with NTLM relay: coercing a DC to authenticate hands attackers a certificate as that high-privilege account, potentially compromising the entire domain.

## Intelligence Metadata

- **Sources:** blog.sentry.security
- **Published:** 2025-01-30T12:05:58Z
- **Original:** https://blog.sentry.security/esc8-attack-guide-for-windows-environments-2/
- **Phying News:** https://phying.com/item/7458