Certipy Execution for AD CS Abuse Post-PaperCut Exploitation

Arnold Chan@slaz

•updated 23 days ago•2•0•6

Detects the execution of Certipy, an open-source tool used for enumerating and exploiting Active Directory Certificate Services (AD CS). The rule monitors for common command-line arguments used during various stages of AD CS attack lifecycle, including finding misconfigurations, requesting certificates, relaying, and template exploitation.