Potential Certighost - AD CS Abuse Alert and Evidence Hunting

Syed Usfar Wasim@nCD24

•updated Aug 7, 2026•9•0•34

Detects Defender XDR alerts and evidence potentially related to Certighost / CVE-2026-54121 AD CS abuse, including suspicious certificate requests, Kerberos activity, LDAP security principal anomalies, and possible DCSync or directory replication abuse.