Public research writings, papers, and books — documenting the things I learn and build.
📖
Systematization of Knowledge (SoK)
(1)
SoK Paper
June 17, 2026 Certificate of Compromise: Offensive Operations against ADCS - Whitepaper
Comprehensive technical reference for the complete ADCS attack taxonomy, ESC1-ESC18, THEFT1-THEFT5, PERSIST1-PERSIST3, and DPERSIST1-DPERSIST3. Covers the impact of KB5014754 binding enforcement.
Zenodo (Preprint) — arXiv cs.CR (pending endorsement)
DOI: 10.5281/zenodo.20732733
Active DirectoryADCSCertificate AbuseOffensive SecurityRed TeamWindows SecurityCertipy
📚
Books
(1)
Book
June 20, 2026 Forged Trust: Offensive Operations against Active Directory Certificate Services
The definitive offensive reference for Active Directory Certificate Services. Documents the complete ADCS attack taxonomy from first principles — ESC1 through ESC18, THEFT1–THEFT5, PERSIST1–PERSIST3, and DPERSIST1–DPERSIST3. Covers exploitation walkthroughs, PKINIT internals, Shadow Credentials, KB5014754 enforcement, and detection opportunities.
Amazon
Active DirectoryADCSCertificate AbuseOffensive SecurityRed TeamWindows SecurityCertipyPKINITShadow Credentials