Detection rules › Splunk
Certificate Enumeration - Windows (Windows Event Log)
Threat actors may use tools such as Certipy or Certify.exe to enumerate misconfigurations in certificate services, allowing them to gather information on potential vulnerabilities that could be exploited for privilege escalation or lateral movement within a network. This use case identifies potential abuse of Active Directory Certificate Services by monitoring file access events (event ID 5145) related to certificate or certification authority data or process creation events (event ID 4688) involving tools commonly used to enumerate or exploit vulnerable configurations in AD CS (e.g., Certipy or Certify).
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1649 Steal or Forge Authentication Certificates |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4688 | A new process has been created. |
| Security-Auditing | Event ID 5145 | A network share object was checked to see whether client can be granted desired access. |
Rule body yaml
id: '36746.64790'
title: Certificate Enumeration - Windows
description: Threat actors may use tools such as Certipy or Certify.exe to enumerate
misconfigurations in certificate services, allowing them to gather information on
potential vulnerabilities that could be exploited for privilege escalation or lateral
movement within a network. This use case identifies potential abuse of Active Directory
Certificate Services by monitoring file access events (event ID 5145) related to
certificate or certification authority data or process creation events (event ID
4688) involving tools commonly used to enumerate or exploit vulnerable configurations
in AD CS (e.g., Certipy or Certify).
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=5145) OR
"<EventID>5145<") (RelativeTargetName="cert" OR RelativeTargetName="certificate"
OR RelativeTargetName="certification_authority")) OR ((TERM(EventCode=4688) OR "<EventID>4688<"
OR Type=Process) ("certipy" OR "find" OR "vulnerable" OR "enrolleeSuppliesSubject"
OR TERM(/ca)) OR "certify.exe") | where match(signature_id, "5145") or (match(signature_id,
"4688") and match(process, "(?i)(certipy|find|vulnerable|enrolleeSuppliesSubject|/ca)\s")
and !match(process_name, "(?i)find\.exe")) or match(process_name, "(?i)certify\.exe")
| table _time, host, user user, process, process_*, parent_*, signature_id | bin
span=1s | stats values(*) as * by _time, host '
techniques:
- credential-access:steal or forge authentication certificates
technique_id:
- T1649
data_category:
- Windows event logs
references:
- https://github.com/ly4k/Certipy
- https://www.kali.org/tools/certipy-ad/
- https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=5145) OR "<EventID>5145<") (RelativeTargetName="cert" OR RelativeTargetName="certificate" OR RelativeTargetName="certification_authority")) OR ((TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) ("certipy" OR "find" OR "vulnerable" OR "enrolleeSuppliesSubject" OR TERM(/ca)) OR "certify.exe")
Stage 2: where
| where match(signature_id, "5145") or (match(signature_id, "4688") and match(process, "(?i)(certipy|find|vulnerable|enrolleeSuppliesSubject|/ca)\s") and !match(process_name, "(?i)find\.exe")) or match(process_name, "(?i)certify\.exe")
Stage 3: table
| table _time, host, user user, process, process_*, parent_*, signature_id
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
RelativeTargetName | eq |
|
process | match |
|
process_name | match |
|
signature_id | match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>5145<" |
| 1 | TERM |
| 1 | "<EventID>4688<" |
| 1 | "certipy" |
| 1 | "find" |
| 1 | "vulnerable" |
| 1 | "enrolleeSuppliesSubject" |
| 1 | "/ca" |
| 1 | "certify.exe" |