Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
116 detections
Filters
Last updated
All Time
Detection languages
43
26
19
12
6
Contributors
26
22
11
11
10
Categories
74
59
25
19
11
Platforms
106
7
1
1
1
Products / Services
51
51
26
21
10
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
5
IDS Classtypes
4
1
1
IDS Protocols
3
2
1
This rule detects potentially malicious activities related to Active Directory Certificate Services (AD CS). It identifies suspicious certificate export commands (certutil, PowerShell), non-privileged processes writing to system certificate stores, and dangerous AD CS enrollment patterns such as Subject Alternative Name (SAN) modifications, often associated with ESC1 privilege escalation techniques.
Detects potential abuse of Active Directory Certificate Services (AD CS) by monitoring for suspicious command-line activity from 'certreq.exe' and 'certutil.exe' associated with certificate enrollment, submission, or management. It also identifies the staging of certificate-related files (.pem, .pfx, .p12, .crt, .cer, .key) in common user directories.
This rule detects potential Active Directory Certificate Services (AD CS) abuse (specifically ESC1 and ESC8 patterns) by monitoring command-line executions of 'certreq.exe' and 'certutil.exe' that utilize suspicious flags or originate from non-standard administrative processes. This activity is indicative of an attacker attempting to enroll certificates for unauthorized entities or escalate privileges within a Windows domain.
This rule detects potentially malicious activities related to Active Directory Certificate Services (AD CS). It identifies suspicious certificate export commands (certutil, PowerShell), non-privileged processes writing to system certificate stores, and dangerous AD CS enrollment patterns such as Subject Alternative Name (SAN) modifications, often associated with ESC1 privilege escalation techniques.
Detects Active Directory Certificate Services (ADCS) certificate enrollment requests where the requester attempts to enroll a certificate with a Subject Alternative Name (SAN) identifying a different principal than the requester's own account. This pattern is indicative of the ESC1 ADCS misconfiguration abuse, which can lead to privilege escalation by impersonating other domain entities.
This rule detects potential Active Directory Certificate Services (AD CS) abuse (specifically ESC1 and ESC8 patterns) by monitoring command-line executions of 'certreq.exe' and 'certutil.exe' that utilize suspicious flags or originate from non-standard administrative processes. This activity is indicative of an attacker attempting to enroll certificates for unauthorized entities or escalate privileges within a Windows domain.
Detects abuse of Active Directory Certificate Services for credential forgery
This rule detects attempts to copy the Active Directory Certificate Services (ADCS) certificate database for offline forgery. Specifically, it looks for SMB traffic to a server on port 445 (SMB) containing the string "certnew.cer" (case-insensitive) in the content, indicating a file transfer of a newly issued certificate. This activity is often associated with credential access techniques, where an attacker might exfiltrate certificate data to forge credentials.
This rule detects attempts to abuse Active Directory Certificate Services (AD CS) by requesting certificates through the /certsrv/ interface. Specifically, it looks for HTTP requests containing both '/certsrv/' and 'request' in the URI, indicating a certificate enrollment request. The thresholding mechanism (5 requests from the same source within 60 seconds) aims to reduce false positives and highlight potentially automated or repeated attempts to exploit AD CS.
This rule detects potential abuse of a Certificate Enrollment Web Service (typically Microsoft's CertEnroll) for forgery attempts. It specifically looks for HTTP requests to the '/certenroll/' URI on port 80 (HTTP) within the home network. A threshold of 10 such requests from a single source IP within 60 seconds is set to trigger the alert, indicating a possible automated or rapid attempt to interact with the certificate enrollment service.
This rule detects network traffic to a specific URI path associated with Active Directory Certificate Services (AD CS) enrollment. The URI '/ADPolicyProvider_CEP_UsernamePassword/service.svc/CEP' is known to be used in Certificate Enrollment Policy (CEP) web services, which can be abused in ESC1 (ESC1 Certificate Template Privilege Escalation) attacks to obtain certificates with elevated privileges. The rule specifically looks for TCP traffic on port 443 (HTTPS) to this URI, indicating an attempt to interact with the CEP service.
This query detects Identity Spoofing via Certificate Request, where a non-machine account (a human user) successfully requests a certificate containing a DNS Name in the Subject Alternative Name (SAN) field—an action typically reserved for servers—indicating the first step of a WSUS hijacking or server impersonation attack.
This attack shares a lot of similarities with ClickFix/FileFix, AiTM phishing, and OAuth Consent Phishing. You can think of this as a browser-native ClickFix attack that phishes an OAuth token on a target app by getting the victim to copy and paste a URL containing OAuth key material into a phishing page.
This rule detects when a certificate is issued to a privileged user. It identifies privileged users by checking their group membership against a predefined list of administrative groups such as 'Domain Admins', 'Enterprise Admins', and 'Administrators'. The rule then looks for Windows Security Event ID 4886, which indicates a certificate services operation, and extracts the principal name from the Subject Alternative Name field. Finally, it joins this information with the identified privileged users to flag any certificate issuance to them.
Detects the addition of a new root certificate authority to an Azure AD tenant. This action can be performed by an attacker to establish persistence and enable certificate-based authentication for unauthorized access, potentially bypassing traditional password-based authentication mechanisms. This is a critical security event as it can lead to privilege escalation and persistent access within the Azure AD environment.
This analytic detects the extraction of authentication certificates using Windows Event Log - CAPI2 (CryptoAPI 2). It specifically leverages EventID 70, which is generated when a certificate's private key is acquired. This detection is significant because it can identify potential misuse of certificates, such as those extracted by tools like Mimikatz or Cobalt Strike. If confirmed malicious, this activity could allow attackers to impersonate users, escalate privileges, or access sensitive information, posing a severe risk to the organization's security.
Detects a potential 'UnPAC the Hash' Kerberos attack, a technique used by Akira ransomware. The attack involves requesting an Active Directory certificate and then using it for a User-to-User (U2U) Kerberos authentication with PKINIT to extract NTLM hashes.
This KQL query monitors a critical security event in Active Directory Federation Services (ADFS) environments - the reading of Distributed Key Management (DKM) properties.
This analytic detects the use of the Certify tool via an in-memory PowerShell function to enumerate Active Directory Certificate Services (AD CS) environments. It leverages PowerShell Script Block Logging (EventCode 4104) to identify specific command patterns associated with Certify's enumeration and exploitation functions. This activity is significant as it indicates potential reconnaissance or exploitation attempts against AD CS, which could lead to unauthorized certificate issuance. If confirmed malicious, attackers could leverage this to escalate privileges, persist in the environment, or access sensitive information by abusing AD CS.
This analytic detects the use of the PowerShell Cmdlet `export-certificate` by leveraging Script Block Logging. This activity is significant as it may indicate an adversary attempting to exfiltrate certificates from the local Certificate Store on a Windows endpoint. Monitoring this behavior is crucial because stolen certificates can be used to impersonate users, decrypt sensitive data, or facilitate further attacks. If confirmed malicious, this activity could lead to unauthorized access to encrypted communications and sensitive information, posing a severe security risk.
The analytic detects the use of the PowerShell cmdlet `export-pfxcertificate` by leveraging Script Block Logging. This activity is significant as it may indicate an adversary attempting to exfiltrate certificates from the Windows Certificate Store. Monitoring this behavior is crucial for identifying potential certificate theft, which can lead to unauthorized access and impersonation attacks. If confirmed malicious, this activity could allow attackers to compromise secure communications, authenticate as legitimate users, and escalate their privileges within the network.
Page 4 of 6