Sigma Rule Library

ADCS Certificate Template Configuration Vulnerability with Risky EKU

Detects certificate creation with template allowing risk permission subject and risky EKU

View on GitHubOpen raw file

Detection logic

selection10

EventID: 4898
TemplateContent|contains:
  - 1.3.6.1.5.5.7.3.2
  - 1.3.6.1.5.2.3.4
  - 1.3.6.1.4.1.311.20.2.2
  - 2.5.29.37.0

selection11

TemplateContent|contains: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT

selection20

EventID: 4899
NewTemplateContent|contains:
  - 1.3.6.1.5.5.7.3.2
  - 1.3.6.1.5.2.3.4
  - 1.3.6.1.4.1.311.20.2.2
  - 2.5.29.37.0

selection21

NewTemplateContent|contains: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT

Condition

(selection10 and selection11) or (selection20 and selection21)

Raw YAML

title: ADCS Certificate Template Configuration Vulnerability with Risky EKU
id: bfbd3291-de87-4b7c-88a2-d6a5deb28668
status: test
description: Detects certificate creation with template allowing risk permission subject and risky EKU
references:
    - https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf
author: Orlinum , BlueDefenZer
date: 2021-11-17
modified: 2022-12-25
tags:
    - attack.privilege-escalation
    - attack.credential-access
logsource:
    product: windows
    service: security
    definition: Certificate services loaded a template would trigger event ID 4898 and certificate Services template was updated would trigger event ID 4899. A risk permission seems to be coming if template contain specific flag with risky EKU.
detection:
    selection10:
        EventID: 4898
        TemplateContent|contains:
            - '1.3.6.1.5.5.7.3.2'
            - '1.3.6.1.5.2.3.4'
            - '1.3.6.1.4.1.311.20.2.2'
            - '2.5.29.37.0'
    selection11:
        TemplateContent|contains: 'CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT'

    selection20:
        EventID: 4899
        NewTemplateContent|contains:
            - '1.3.6.1.5.5.7.3.2'
            - '1.3.6.1.5.2.3.4'
            - '1.3.6.1.4.1.311.20.2.2'
            - '2.5.29.37.0'
    selection21:
        NewTemplateContent|contains: 'CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT'

    condition: (selection10 and selection11) or (selection20 and selection21)
falsepositives:
    - Administrator activity
    - Proxy SSL certificate with subject modification
    - Smart card enrollement
level: high

False positives

  • Administrator activity
  • Proxy SSL certificate with subject modification
  • Smart card enrollement

References