HackTool - Certipy Execution
Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments. Certipy can be used to enumerate Active Directory Certificate Services (AD CS) for misconfigurations, request certificates, and perform various attacks such as forging authentication certificates (ESC1, ESC2, ESC3, ESC4, ESC6, ESC7, ESC8, ESC9, ESC10). The rule looks for the executable name, original file name, description containing 'Certipy', or specific command-line arguments and flags commonly used by Certipy.
Sigma
