Detection rules › Splunk
Certificate Abuse - Windows (Sysmon)
Threat actors may use tools such as Certipy or Certify.exe to enumerate misconfigurations in certificate services, allowing them to gather information on potential vulnerabilities that could be exploited for privilege escalation or lateral movement within a network. This use case identifies potential abuse of Active Directory Certificate Services by monitoring Certificate Services events (4886 and 4887) or process creation events (event ID 4688) involving tools commonly used to exploit vulnerable configurations in AD CS such as certify.exe, accounting for instances where the binary has been renamed.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access |
References
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule body
id: '38494.69242'
title: Certificate Abuse - Windows
description: Threat actors may use tools such as Certipy or Certify.exe to enumerate
misconfigurations in certificate services, allowing them to gather information on
potential vulnerabilities that could be exploited for privilege escalation or lateral
movement within a network. This use case identifies potential abuse of Active Directory
Certificate Services by monitoring Certificate Services events (4886 and 4887) or
process creation events (event ID 4688) involving tools commonly used to exploit
vulnerable configurations in AD CS such as certify.exe, accounting for instances
where the binary has been renamed.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
("certify.exe" OR "request " OR "/ca:" OR "/template:" OR "/altname:") | where match(process,
"(?i)request\s.+/ca:.+/(template|altname):") | table _time, host, user user, process,
process_*, parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- credential-access:steal or forge authentication certificates
technique_id:
- T1649
data_category:
- Windows Sysmon
references:
- https://github.com/ly4k/Certipy
- https://www.kali.org/tools/certipy-ad/
- https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<") ("certify.exe" OR "request " OR "/ca:" OR "/template:" OR "/altname:")
Stage 2: where
| where match(process, "(?i)request\s.+/ca:.+/(template|altname):")
Stage 3: table
| table _time, host, user user, process, process_*, parent_*
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq value:"1" |
process | regex_match |
| field:"CommandLine" kind:regex_match |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "<EventID>1<" |
| 1 | "certify.exe" |
| 1 | "request " |
| 1 | "/ca:" |
| 1 | "/template:" |
| 1 | "/altname:" |