Steal or Forge Authentication Certificates detection rulesT1649

Detects a Domain Controller machine account authenticating from a source IP that is not a known Domain Controller. DC machine accounts should only authenticate locally or from other DCs during replication operations. Any logon event for a DC account from a workstation or non-DC host is anomalous and indicates one of the following: - Silver Ticket: attacker forged a Kerberos TGS for a DC machine account without requesting a TGT - Pass-the-Ticket: attacker is replaying a captured DC machine account TGS from a non-DC host - Overpass-the-Hash: attacker converted a stolen DC machine account hash into a Kerberos ticket and is authenticating from a non-DC host - Exploitation of certain vulnerabilities such as CVE-2026-54121 (Certighost): attacker obtained a DC certificate via ADCS CDC-chase abuse, authenticates via PKINIT as the DC from their own host, then performs DCSync

windows

Detects Active Directory Certificate Services (ADCS) certificate requests that include the 'cdc' (Client DC) request attribute pointing to a domain or IP that is not a known Domain Controller. 'cdc' is an optional MS-WCCE enrollment attribute designed for cross-domain/cross-forest scenarios where a client in a child domain tells the CA which DC to contact for identity lookups when the CA cannot reach that domain directly. Legitimate values are DC hostnames or IPs that resolve to a real Domain Controller computer object in AD with the SERVER_TRUST_ACCOUNT (0x2000) userAccountControl bit set. In an attack, the attacker sets cdc to a domain or IP they control so the CA connects to their rogue SMB and LDAP services instead of a real DC. The rogue server returns a forged DC identity which the pre-patch CA accepts without validation. A malicious event looks like: Requester: DOMAIN\GHOST<random>$ Attributes: cdc:<attacker_ip> rmd:<target_dc_fqdn> SubjectAlternativeName: DNS Name=<target_dc_fqdn> CVE-2026-54121 (Certighost) is the known exploit for this path. The July 2026 patch added _ValidateChaseTargetIsDC which rejects cdc values that do not resolve to a legitimate DC object in Active Directory before following the chase.

windows

Detects successful issuance of an ADCS certificate where the request attributes include 'cdc' (Client DC) or 'rmd' (Remote Domain) pointing to a non-DC domain or IP, confirming the CA's chase fallback path was taken against an attacker-controlled target. 'cdc' directs the CA to an address for identity lookup; 'rmd' specifies the principal to look up there. In an attack (CVE-2026-54121, Certighost), cdc points to a rogue host that returns a forged DC identity. A successfully issued certificate at this stage means the attacker has obtained a cert carrying a Domain Controller's SID and DNS identity, enabling PKINIT authentication as that DC followed by DCSync replication.

windows

Detects the creation of a machine account whose name starts with 'GHOST', which is the naming convention used by the CVE-2026-54121 (Certighost) exploit tooling. The public proof-of-concept for Certighost creates a temporary machine account with a name of the form GHOST<random>$ before enrolling for a DC certificate via the cdc chase path. The attacker-controlled machine account is used as the requester identity in the certificate request; the cdc attribute then redirects the CA to a rogue host that returns a forged Domain Controller identity. The resulting certificate carries the DC's SID and DNS name, enabling full PKINIT authentication as the targeted DC followed by DCSync. A machine account creation event (4741) where TargetUserName starts with 'GHOST' and ends with '$' is a high-fidelity indicator of this attack tool's execution. Legitimate environments very rarely provision machine accounts with this prefix.

windows

Detects the Windows Certificate Services process (certsrv.exe) initiating an outbound network connection on port 445 (SMB) or 389 (LDAP) to a non-DC host. This behaviour is inherently suspicious: under normal operation the CA resolves subject identities via local RPC against the domain and never initiates outbound SMB or LDAP connections to arbitrary hosts. Any such connection indicates the CA is being coerced into performing a remote identity lookup against an attacker-controlled host. The most direct known trigger is the CA chase fallback (EDITF_ENABLECHASECLIENTDC) where a requester-supplied 'cdc' attribute causes the CA to open SMB and LDAP to a specified address. CVE-2026-54121 (Certighost) exploits this path to redirect the CA to rogue LSA and LDAP services that return a DC's identity, resulting in a forged DC certificate. This rule is not limited to Certighost — any future vulnerability or misconfiguration that causes certsrv.exe to make outbound SMB or LDAP connections is covered.

windows · network_connection

Detects a Kerberos TGT request (Event 4768) for a known Domain Controller machine account originating from an IP address that is not a known Domain Controller. DC machine accounts should only request TGTs from their own IP. Any TGT request for a DC account from a workstation or non-DC host is anomalous and indicates one of the following: - PKINIT abuse (CVE-2026-54121 / Certighost): attacker authenticating as a DC via a forged certificate from their workstation - Overpass-the-Hash: attacker converting a stolen DC machine account NTLM hash into a Kerberos TGT - Pass-the-Hash (RC4): attacker using the DC machine account hash directly with Kerberos

windows

Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command line arguments.

windows · process_creation

Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments.

windows · process_creation

Detects when an application exports a certificate (and potentially the private key as well) from the local Windows certificate store.

windows

Detects when an application acquires a certificate private key

windows

Detects logon with "Special groups" and "Special Privileges" can be thought of as Administrator groups or privileges.

windows