[mykeelium]

Description

Adds coverage for the ADCS ESC11 attack path. ESC11 exploits Enterprise Certificate Authorities whose RPC endpoint does not enforce encryption, allowing attackers to relay coerced NTLM authentication and impersonate domain principals.

This PR implements:

• New EnterpriseCA properties:
  • RPCEncryptionEnforced
  • RPCEncryptionCollected
• A new DCA post-processed CoerceAndRelayNTLMToADCSRPC edge.
  • CoerceAndRelayNTLMToADCS requires HasVulnerableEndpoint=true.
  • CoerceAndRelayNTLMToADCSRPC requires RPCEncryptionEnforced=false.
  • CoerceAndRelayNTLMToADCS is updated to use DCA as well.
• Edge composition and relay-target support for the new relationship.
• A saved Cypher query for locating Enterprise CAs vulnerable to ESC11.
• Helptext covering abuse, operational security, references, composition, and relay targets.

NTLM registry ingestion fix

This PR also fixes missing CoerceAndRelayNTLM edges when SharpHound successfully collects NTLM registry data but Windows policies are not explicitly configured.

When NTLMRegistryData.Collected=true, ingestion now applies stable Windows defaults:

• RestrictOutboundNTLM=false
• RestrictReceivingNTLMTraffic=false
• ClientAllowedNTLMServers=[]
• EnableSecuritySignature is derived from whether the computer is a domain controller

Resolves BED-6182

How Has This Been Tested?

Using this dataset:
20250611101235_BloodHound_esc11.zip

Screenshots (optional):

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)

Checklist:

• I have met the contributing prerequisites
  • Assigned myself to this PR
  • Added the appropriate labels
  • Associated an issue: Issues and Pull Requests README #672
  • Read the Contributing guide: https://github.com/SpecterOps/BloodHound/wiki/Contributing
• I have ensured that related documentation is up-to-date
  • Open API docs
  • Code comments (GoDocs / JSDocs)
• I have followed proper test practices
  • Added/updated tests to cover my changes
  • All new and existing tests passed

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Essentials
• Run ID: 6df14d18-2efe-4263-bdb4-513a6ae1681b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[mykeelium]

Replaced by the stacked PRs: #3492 (RPC encryption data), #3493 (ESC11 analysis), and #3494 (frontend support). Please review those instead.