Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
116 detections
Filters
Last updated
All Time
Detection languages
43
26
19
12
6
Contributors
26
22
11
11
10
Categories
74
59
25
19
11
Platforms
106
7
1
1
1
Products / Services
51
51
26
21
10
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
5
IDS Classtypes
4
1
1
IDS Protocols
3
2
1
This rule monitors for successful certificate enrollments (Event ID 4886 and 4887) using sensitive certificate templates typically reserved for domain controllers or Kerberos authentication. It specifically alerts when these requests are made by user accounts that do not end in '$' (machine accounts) and are not known service accounts like 'CAService', which may indicate unauthorized attempts to obtain high-privilege credentials via AD Certificate Services (AD CS).
Detects instances where a user account requests or enrolls a certificate from Active Directory Certificate Services (AD CS) that is associated with a computer account (SID). This behavior, specifically when the requester is not the computer account itself, is a known indicator of potential AD CS abuse, such as certificate theft or impersonation techniques.
This Defender XDR query detects high-confidence attempts to export certificates with private keys using native Windows utilities, PowerShell, Mimikatz, AADInternals, Certipy, OpenSSL, and certificate-management tools.
Detects Defender XDR alerts and evidence potentially related to Certighost / CVE-2026-54121 AD CS abuse, including suspicious certificate requests, Kerberos activity, LDAP security principal anomalies, and possible DCSync or directory replication abuse.
This KQL is designed to hunt for activity that may indicate Active Directory Certificate Services abuse or Certighost-like domain compromise behavior, especially where an attacker may manipulate machine account attributes, impersonate domain-controller-like behavior, or perform follow-on credential extraction.
Detects malicious certificate enrollment requests targeting Active Directory Certificate Services (AD CS) that utilize legacy 'cdc' (Client DC) or 'rmd' (Remote Domain) request attributes, a technique associated with the 'Certighost' exploit (CVE-2026-54121). Additionally, the rule monitors the CA process (certsrv.exe) for suspicious outbound SMB or LDAP connections, which may indicate the abuse of AD CS chase fallback logic to coerce authentication.
Detects modifications to the 'msDS-KeyCredentialLink' attribute on user or computer objects within Active Directory. This attribute is targeted in 'Shadow Credentials' attacks (e.g., using tools like Whisker, pyWhisker, or DSInternals) to add an attacker-controlled public key, allowing for PKINIT-based authentication as the victim account without knowing the password.
Detects the execution of 'certighost.py', a Python-based tool used to exploit CVE-2026-54121. The detection monitors process command lines for the specific script name in combination with command-line arguments (such as --dc-ip, --template, --computer-name, etc.) used to abuse the AD CS chase enrollment flow for malicious certificate requests.
Detects anomalous certificate issuance via Active Directory Certificate Services (AD CS) where a machine-template certificate is issued to a non-computer requester, but the issued certificate's Subject Alternative Name contains a dNSHostName identifier associated with a Domain Controller. This pattern matches the exploitation of the 'CertiGhost' vulnerability (CVE-2026-54121), which allows unauthorized entities to obtain certificates masquerading as Domain Controllers for potential Kerberos authentication abuse.
Detects Active Directory Certificate Services (AD CS) certificate request or issuance events where the request attributes contain 'cdc=' or 'rmd=' parameters. These parameters are indicative of the CertiGhost (CVE-2026-54121) exploit, where an attacker coerces the Certificate Authority to interact with an attacker-controlled LDAP or LSA listener by abusing chase-abuse flows during the certificate request process.
This rule detects potential Active Directory Certificate Services (ADCS) ESC17 abuse by monitoring for certificate requests that contain a Subject Alternative Name (SAN) or Common Name (CN) matching trusted external domains such as 'login.microsoftonline.com'. It also monitors for Certipy command-line activity targeting insecure web server templates or attempting ESC17-specific maneuvers, which indicates an attempt to forge certificates for domain impersonation or unauthorized authentication.
Detects instances where FortiClient EMS (versions 7.4.5 or 7.4.6) logs a 'Certificate not found in request header' error. This indicates that a client attempt to communicate with the EMS server failed due to missing certificate-based authentication, which could suggest misconfiguration, network issues, or potentially an unauthorized attempt to access the management interface.
Detects Active Directory Certificate Services (ADCS) certificate enrollment requests where the requester attempts to enroll a certificate with a Subject Alternative Name (SAN) identifying a different principal than the requester's own account. This pattern is indicative of the ESC1 ADCS misconfiguration abuse, which can lead to privilege escalation by impersonating other domain entities.
Detects Active Directory Certificate Services (ADCS) certificate enrollment requests where the requester attempts to enroll a certificate with a Subject Alternative Name (SAN) identifying a different principal than the requester's own account. This pattern is indicative of the ESC1 ADCS misconfiguration abuse, which can lead to privilege escalation by impersonating other domain entities.
Detects certificate requests containing indicators often associated with Active Directory Certificate Services (AD CS) abuse, such as requests involving Subject Alternative Name (SAN) or smart card authentication attributes, which may indicate attempts to escalate privileges or move laterally via certificate forgery.
Detects certificate requests containing indicators often associated with Active Directory Certificate Services (AD CS) abuse, such as requests involving Subject Alternative Name (SAN) or smart card authentication attributes, which may indicate attempts to escalate privileges or move laterally via certificate forgery.
Detects Active Directory Certificate Services (ADCS) certificate enrollment requests where the requester attempts to enroll a certificate with a Subject Alternative Name (SAN) identifying a different principal than the requester's own account. This pattern is indicative of the ESC1 ADCS misconfiguration abuse, which can lead to privilege escalation by impersonating other domain entities.
Detects potential abuse of Active Directory Certificate Services (AD CS) by monitoring for suspicious command-line activity from 'certreq.exe' and 'certutil.exe' associated with certificate enrollment, submission, or management. It also identifies the staging of certificate-related files (.pem, .pfx, .p12, .crt, .cer, .key) in common user directories.
This rule monitors Active Directory Certificate Services (AD CS) event logs for signs of potential privilege escalation and credential abuse. It specifically targets indicators of ESC1 (AD CS misconfigurations allowing requester-supplied SANs), identifies requests for certificates by non-owners for privileged accounts, and monitors for the use of PKI-based Kerberos authentication against high-privilege targets.
This rule monitors Active Directory Certificate Services (AD CS) event logs for signs of potential privilege escalation and credential abuse. It specifically targets indicators of ESC1 (AD CS misconfigurations allowing requester-supplied SANs), identifies requests for certificates by non-owners for privileged accounts, and monitors for the use of PKI-based Kerberos authentication against high-privilege targets.
Detects unauthorized access to sensitive cryptographic files, such as SSH private keys, GPG secret keys, or Windows certificate store files, by unauthorized or anomalous processes (specifically node/npm or processes within /tmp). This is followed by potential outbound exfiltration via an external network connection or the mass access of multiple sensitive files within a short timeframe.
Page 3 of 6