A 14-week offensive security research internship at Refracted Security — producing a complete Active Directory Certificate Services vulnerability catalog (ESC1–ESC16), custom stealth-focused enumeration tooling in PowerShell and Python, a detection gap analysis using Wazuh and Sysmon, and an end-to-end cross-domain trust exploitation case study.
Official academic documents produced for Thomas More as part of the internship programme, placed here for quick access.
Full technical write-up of the internship assignment — AD CS research, tooling development, monitoring analysis, and cross-domain trust case study. 32 pages.
Initial project plan submitted at the start of the internship — scope, objectives, deliverables, phases, and risk analysis for the AD CS security research assignment.
Personal reflection document covering the internship period — learning outcomes, challenges, and professional development.
Download bundle containing the documentation files currently included in the project.
Refracted is a technical cybersecurity firm specializing in red teaming, OSINT, penetration testing, and incident response. Their team of certified professionals focuses on identifying what is truly at risk — not following trends. One of the few organizations in Belgium offering specialized Red Team internships.
Their "spectrum" model integrates multiple security color teams into a unified defense posture — Red, Blue, Yellow, and everything between. The name reflects this: security broken into its component wavelengths, then unified.
Refracted regularly encounters AD CS in client environments during pentests. The problem: AD CS knowledge was fragmented across external blogs, research papers, and tooling documentation — no internal structured reference for consultants during live engagements.
The project's value proposition was clear: build the internal knowledge base. Research ESC1–ESC16 systematically, reproduce each attack path in a lab, develop stealth-focused tooling, and evaluate what a basic SOC actually sees during these attacks.
Yannick Hendrickx — internship mentor at Refracted — provided technical guidance throughout and the freedom to shape the direction of the research. High-level discussions on AD and Red Team methodology were central to the project's development. The autonomous scope, with intentional flexibility to evolve the assignment based on findings, was a deliberate design choice.
The assignment was executed in three concurrent phases, each feeding the others — research informed tooling, tooling validated research, and detection analysis evaluated both.
AD CS vulnerabilities generally fall into three structural categories. Understanding which category a given ESC falls into shapes the attack approach, the tools required, and the detection surface.
For each ESC, the research covered: core attack logic, required conditions (template attributes, ACL state, protocol exposure), exploitation walkthrough, and mitigation controls. The full technical documentation was delivered to Refracted's internal knowledge base.
Public tools like Certipy are noisy because they retrieve and analyze all certificate templates client-side. The custom scripts delegate filtering to the Domain Controller via targeted LDAP queries — reducing observable events to near zero under realistic monitoring conditions.
# Standard noisy approach — retrieves ALL templates, filters client-side # Get-ADObject -SearchBase "CN=Certificate Templates,..." -Filter * # Targeted approach — LDAP filter handles matching server-side # Only templates with ENROLLEE_SUPPLIES_SUBJECT + auth EKU are returned # Result: single short-lived LDAP query, <5ms, no alertable 1644 event Get-ADObject -SearchBase "CN=Certificate Templates,CN=Public Key Services,..." ` -LDAPFilter "(&(objectClass=pKICertificateTemplate)(msPKI-Certificate-Name-Flag:1.2.840.113556.1.4.804:=1)(|(pKIExtendedKeyUsage=1.3.6.1.5.5.7.3.2)(pKIExtendedKeyUsage=1.3.6.1.4.1.311.20.2.2)))" ` -Properties 'msPKI-Certificate-Name-Flag','pKIExtendedKeyUsage','nTSecurityDescriptor' # → Zero observable 1644 events. Blends with routine directory activity.
Beyond AD CS, the internship extended into trust-based attack primitives — how certificate-based authentication bypasses traditional Kerberos trust boundaries and what that means for forest-level security.
xyz$ inter-realm trust account.Wazuh + Sysmon deployed on DC and CA. Custom rules written. Public tools and custom scripts compared. The results were more concerning than expected.
<group name="ad_recon"> <rule id="110000" level="0"> <if_sid>60000, 60009</if_sid> <field name="win.system.channel">^Directory Service$</field> <description>Windows Directory Service channel group</description> </rule> <rule id="110001" level="5"> <if_sid>110000</if_sid> <field name="win.system.eventID">^1644$</field> <description>AD DS: LDAP search operation (Event 1644) — potential AD CS recon</description> </rule> </group>
The internship confirmed that AD CS is one of the most underestimated attack surfaces in enterprise environments — routinely deployed, rarely audited, and poorly understood by the defenders tasked with protecting it. The combination of offensive research and defensive analysis in the same project made the detection gap findings concrete rather than theoretical.
Working at a small, highly technical firm with direct access to experienced red teamers compressed the learning curve considerably. The freedom to shape the assignment's direction — choosing AD CS, expanding into trust research, deciding to benchmark detection visibility — made the outcome significantly more valuable than a prescriptive project would have been.