adcs-template-abuse
Exploits misconfigured AD CS certificate templates to impersonate any domain user via SAN manipulation or enrollment agent abuse. Covers ESC1 (enrollee supplies subject), ESC2 (any-purpose/no EKU), ES
Also installable via skills CLI
npx skills add blacklanternsecurity/red-run/skills/ad/adcs-template-abuse