Detection rules › Kusto
Detection Opportunities for Certighost (CVE-2026-54121)
Telemetry coverage
Rule body
DeviceNetworkEvents
| where ActionType == "ListeningConnectionCreated"
| where LocalPort == 389
| where DeviceName !in~ ("list of domain controllers")
// Author: Cyb3rMonk(https://twitter.com/Cyb3rMonk, https://academy.bluraven.io)
//
let domain_controllers = pack_array("list of domain controllers");
let domain_controller_ips = pack_array("IP addresses of domain controllers");
DeviceLogonEvents
| where AccountName has_any (domain_controllers)
| where isnotempty(RemoteIP)
| where RemoteIP !in ("::1", "127.0.0.1", "-")
| where RemoteIP !startswith "fe80::"
| where RemoteIP !in (domain_controller_ips)
// Author: Cyb3rMonk(https://twitter.com/Cyb3rMonk, https://academy.bluraven.io)
//
let domain_controllers = pack_array("list of domain controllers");
let domain_controller_ips = pack_array("IP addresses of domain controllers");
SecurityEvent
| where EventID == 4624
| where TargetUserName has_any (domain_controllers)
| where isnotempty(IpAddress)
| where IpAddress !in ("::1", "127.0.0.1", "-")
| where IpAddress !startswith "fe80::"
| where IpAddress !in (domain_controller_ips)
| project-reorder TimeGenerated, Computer, TargetUserName, IpAddress
let domain_controller_fqdns = pack_array("list of domain controller fqdns");
let domain_controller_ips = pack_array("IP addresses of domain controllers");
SecurityEvent
| where EventID in (4886, 4887, 4888)
| extend cdc = extract(@'cdc:(\S+)', 1, Attributes), rmd = extract(@'rmd:(\S+)', 1, Attributes)
| where not (cdc in~ (domain_controller_ips) or cdc in~ (domain_controller_fqdns))
Stages and Predicates
Stage 1: source
DeviceNetworkEvents
Stage 2: where
where ActionType =~ "ListeningConnectionCreated"
Stage 3: where
where LocalPort == 389
Stage 4: where
where not (DeviceName =~ "list of domain controllers")
Stage 5: source
DeviceLogonEvents
Stage 6: where
where AccountName contains "domain_controllers"
Stage 7: where
where isnotempty(RemoteIP)
Stage 8: where
where not (RemoteIP in~ ("-", "127.0.0.1", "::1"))
Stage 9: where
where not (RemoteIP startswith "fe80::")
Stage 10: where
where not (RemoteIP =~ "domain_controller_ips")
Stage 11: source
SecurityEvent
Stage 12: where
where EventID == 4624
Stage 13: where
where TargetUserName contains "domain_controllers"
Stage 14: where
where isnotempty(IpAddress)
Stage 15: where
where not (IpAddress in~ ("-", "127.0.0.1", "::1"))
Stage 16: where
where not (IpAddress startswith "fe80::")
Stage 17: where
where not (IpAddress =~ "domain_controller_ips")
Stage 18: project-reorder
project-reorder
Stage 19: source
SecurityEvent
Stage 20: where
where EventID in~ (4886, 4887, 4888)
Stage 21: extend
extend cdc, rmd
Stage 22: where
where not ((cdc =~ "domain_controller_fqdns" or cdc =~ "domain_controller_ips"))
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
DeviceName | eq | list of domain controllers | excludes:DeviceName field:"DeviceName" value:"list of domain controllers" |
RemoteIP | in | -, 127.0.0.1, ::1 | excludes:RemoteIP field:"RemoteIP" value:"-" field:"RemoteIP" value:"127.0.0.1" field:"RemoteIP" value:"::1" |
RemoteIP | starts_with | fe80:: | excludes:RemoteIP field:"RemoteIP" value:"fe80::" |
RemoteIP | eq | domain_controller_ips | excludes:RemoteIP field:"RemoteIP" value:"domain_controller_ips" |
IpAddress | in | -, 127.0.0.1, ::1 | excludes:IpAddress field:"IpAddress" value:"-" field:"IpAddress" value:"127.0.0.1" field:"IpAddress" value:"::1" |
IpAddress | starts_with | fe80:: | excludes:IpAddress field:"IpAddress" value:"fe80::" |
IpAddress | eq | domain_controller_ips | excludes:IpAddress field:"IpAddress" value:"domain_controller_ips" |
cdc | eq | domain_controller_fqdns | excludes:cdc field:"cdc" value:"domain_controller_fqdns" |
cdc | eq | domain_controller_ips | excludes:cdc field:"cdc" value:"domain_controller_ips" |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
AccountName | match |
| field:"user" kind:match value:"domain_controllers" |
ActionType | eq |
| field:"ActionType" kind:eq value:"ListeningConnectionCreated" |
EventID | eq |
| field:"EventID" kind:eq value:"4624" |
EventID | in |
| field:"EventID" kind:in |
IpAddress | is_not_null | field:"src_ip" kind:is_not_null | |
LocalPort | eq |
| field:"SourcePort" kind:eq value:"389" |
RemoteIP | is_not_null | field:"DestinationIp" kind:is_not_null | |
TargetUserName | match |
| field:"TargetUserName" kind:match value:"domain_controllers" |