Skip to content

Commit 8eaafff

Browse files
swachchhanda000swachchhanda000
authored
Merge PR #6190 from @swachchhanda000 - Add CertiGhost Rules
new: ADCS - Certificate Request With CDC Chase Attribute new: ADCS - Certificate Issued via CDC Chase Mechanism new: Certificate Services Outbound SMB or LDAP Connection new: DC Machine Account TGT Request from Non-DC Source IP new: DC Machine Account TGS Request from Non-DC Source IP new: DC Machine Account Network Logon from Non-DC Source IP
1 parent 226e0f8 commit 8eaafff

10 files changed

Lines changed: 433 additions & 53 deletions

‎rules-emerging-threats/2026/Exploits/CVE-2026-54121/win_security_adcs_certighost_cdc_chase_request.yml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
title: ADCS - Certighost CDC Chase Certificate Request (CVE-2026-54121)
2+
id: c4a1f389-2e6b-4d9a-8f0c-b73e5a12d947
3+
related:
4+
- id: 2a9e4f17-6c3b-4d8a-e1f0-b57c2d94a631
5+
type: similar
6+
status: experimental
7+
description: |
8+
Detects Active Directory Certificate Services (ADCS) certificate requests that include the
9+
'cdc' (Client DC) request attribute pointing to a domain or IP that is not a known Domain Controller.
10+
11+
'cdc' is an optional MS-WCCE enrollment attribute designed for cross-domain/cross-forest
12+
scenarios where a client in a child domain tells the CA which DC to contact for identity
13+
lookups when the CA cannot reach that domain directly. Legitimate values are DC hostnames
14+
or IPs that resolve to a real Domain Controller computer object in AD with the
15+
SERVER_TRUST_ACCOUNT (0x2000) userAccountControl bit set.
16+
17+
In an attack, the attacker sets cdc to a domain or IP they control so the CA connects to their
18+
rogue SMB and LDAP services instead of a real DC. The rogue server returns a forged DC
19+
identity which the pre-patch CA accepts without validation. A malicious event looks like:
20+
21+
Requester: DOMAIN\GHOST<random>$
22+
Attributes: cdc:<attacker_ip>
23+
rmd:<target_dc_fqdn>
24+
SubjectAlternativeName: DNS Name=<target_dc_fqdn>
25+
26+
CVE-2026-54121 (Certighost) is the known exploit for this path. The July 2026 patch added
27+
_ValidateChaseTargetIsDC which rejects cdc values that do not resolve to a legitimate
28+
DC object in Active Directory before following the chase.
29+
references:
30+
- https://github.com/aniqfakhrul/CVE-2026-54121
31+
- https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26
32+
author: Swachchhanda Shrawan Poudel (Nextron Systems)
33+
date: 2026-07-27
34+
tags:
35+
- attack.privilege-escalation
36+
- attack.credential-access
37+
- attack.t1649
38+
- cve.2026-54121
39+
- detection.emerging-threats
40+
logsource:
41+
product: windows
42+
service: security
43+
definition: |
44+
This requires two independent controls on the CA server.
45+
(1) CA\AuditFilter must have bit 0x04 (AUDIT_CERTSRV_REQUESTFLAGS) set
46+
this instructs certsrv.exe to emit request/issuance events.
47+
Without this bit the CA never calls ReportEvent() for certificate operations, regardless of OS policy.
48+
- Set via: certutil -setreg CA\AuditFilter 127 then net stop CertSvc; net start CertSvc.
49+
(2) The OS audit subcategory must be enabled to write those events into the Security log:
50+
auditpol /set /subcategory:"Certification Services" /success:enable.
51+
Note: GPO alone (without AuditFilter) is not sufficient.
52+
detection:
53+
selection:
54+
EventID: 4886
55+
Attributes|contains: 'cdc:'
56+
filter_main_known_cdc:
57+
Attributes|contains|expand: '%known_cdcs%' # should be populated with all known legitimate DC hostnames and IPs
58+
condition: selection and not 1 of filter_main_*
59+
falsepositives:
60+
- Unknown
61+
level: high

‎rules-emerging-threats/2026/Exploits/CVE-2026-54121/win_security_adcs_certighost_cert_issued_via_chase.yml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
title: ADCS - Certighost Certificate Issued via CDC Chase (CVE-2026-54121)
2+
id: 8b7e2c54-1f93-4a6d-b8e0-3c9d7f25a168
3+
status: experimental
4+
description: |
5+
Detects successful issuance of an ADCS certificate where the request attributes include
6+
'cdc' (Client DC) or 'rmd' (Remote Domain) pointing to a non-DC domain or IP, confirming the
7+
CA's chase fallback path was taken against an attacker-controlled target.
8+
9+
'cdc' directs the CA to an address for identity lookup; 'rmd' specifies the principal to
10+
look up there. In an attack (CVE-2026-54121, Certighost), cdc points to a rogue host that
11+
returns a forged DC identity. A successfully issued certificate at this stage means the
12+
attacker has obtained a cert carrying a Domain Controller's SID and DNS identity, enabling
13+
PKINIT authentication as that DC followed by DCSync replication.
14+
references:
15+
- https://github.com/aniqfakhrul/CVE-2026-54121
16+
- https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26
17+
author: Swachchhanda Shrawan Poudel (Nextron Systems)
18+
date: 2026-07-27
19+
tags:
20+
- attack.privilege-escalation
21+
- attack.credential-access
22+
- attack.t1649
23+
- cve.2026-54121
24+
- detection.emerging-threats
25+
logsource:
26+
product: windows
27+
service: security
28+
definition: |
29+
This requires two independent controls on the CA server.
30+
(1) CA\AuditFilter must have bit 0x04 (AUDIT_CERTSRV_REQUESTFLAGS) set
31+
this instructs certsrv.exe to emit request/issuance events.
32+
Without this bit the CA never calls ReportEvent() for certificate operations, regardless of OS policy.
33+
- Set via: certutil -setreg CA\AuditFilter 127 then net stop CertSvc; net start CertSvc.
34+
(2) The OS audit subcategory must be enabled to write those events into the Security log:
35+
auditpol /set /subcategory:"Certification Services" /success:enable.
36+
Note: GPO alone (without AuditFilter) is not sufficient.
37+
detection:
38+
selection:
39+
EventID: 4887
40+
Attributes|contains:
41+
- 'cdc:'
42+
- 'rmd:'
43+
filter_main_known_cdc_ips:
44+
Attributes|contains|expand: '%known_cdcs%' # should be populated with all known legitimate DC hostnames and IPs
45+
condition: selection and not 1 of filter_main_*
46+
falsepositives:
47+
- Unknown
48+
level: high

‎rules-emerging-threats/2026/Exploits/CVE-2026-54121/win_security_adcs_certighost_ghost_machine_account_creation.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
title: ADCS - Certighost Ghost Machine Account Creation
2+
id: fa0bac5f-d170-4a91-9780-1ad71dc1f49e
3+
status: experimental
4+
description: |
5+
Detects the creation of a machine account whose name starts with 'GHOST', which is the
6+
naming convention used by the CVE-2026-54121 (Certighost) exploit tooling.
7+
8+
The public proof-of-concept for Certighost creates a temporary machine account with a
9+
name of the form GHOST<random>$ before enrolling for a DC certificate via the cdc chase
10+
path. The attacker-controlled machine account is used as the requester identity in the
11+
certificate request; the cdc attribute then redirects the CA to a rogue host that returns
12+
a forged Domain Controller identity. The resulting certificate carries the DC's SID and
13+
DNS name, enabling full PKINIT authentication as the targeted DC followed by DCSync.
14+
15+
A machine account creation event (4741) where TargetUserName starts with 'GHOST' and
16+
ends with '$' is a high-fidelity indicator of this attack tool's execution. Legitimate
17+
environments very rarely provision machine accounts with this prefix.
18+
references:
19+
- https://github.com/aniqfakhrul/CVE-2026-54121
20+
- https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26
21+
author: Swachchhanda Shrawan Poudel (Nextron Systems)
22+
date: 2026-07-30
23+
tags:
24+
- attack.privilege-escalation
25+
- attack.credential-access
26+
- attack.persistence
27+
- attack.t1136.002
28+
- attack.t1649
29+
- cve.2026-54121
30+
- detection.emerging-threats
31+
logsource:
32+
product: windows
33+
service: security
34+
definition: |
35+
Requirements:
36+
Audit Policy : Account Management > Audit Computer Account Management
37+
detection:
38+
selection:
39+
EventID: 4741
40+
TargetUserName|startswith: 'GHOST'
41+
TargetUserName|endswith: '$'
42+
condition: selection
43+
falsepositives:
44+
- Unlikely
45+
level: high

‎rules-placeholder/windows/builtin/security/win_security_dc_machine_account_logon_non_dc_ip.yml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
title: DC Machine Account Network Logon from Non-DC Source IP
2+
id: b2e4a719-3c8f-4d1b-a507-f83c2d56e901
3+
status: experimental
4+
description: |
5+
Detects a Domain Controller machine account authenticating from a source IP that is not
6+
a known Domain Controller. DC machine accounts should only authenticate locally or from other DCs during
7+
replication operations. Any logon event for a DC account from a workstation or non-DC host is anomalous and
8+
indicates one of the following:
9+
10+
- Silver Ticket: attacker forged a Kerberos TGS for a DC machine account without
11+
requesting a TGT
12+
- Pass-the-Ticket: attacker is replaying a captured DC machine account TGS from
13+
a non-DC host
14+
- Overpass-the-Hash: attacker converted a stolen DC machine account hash into a
15+
Kerberos ticket and is authenticating from a non-DC host
16+
- Exploitation of certain vulnerabilities such as CVE-2026-54121 (Certighost):
17+
attacker obtained a DC certificate via ADCS CDC-chase
18+
abuse, authenticates via PKINIT as the DC from their own host, then performs DCSync
19+
references:
20+
- https://github.com/aniqfakhrul/CVE-2026-54121
21+
author: Swachchhanda Shrawan Poudel (Nextron Systems)
22+
date: 2026-07-29
23+
tags:
24+
- attack.credential-access
25+
- attack.lateral-movement
26+
- attack.t1550.003
27+
- attack.t1558.002
28+
- attack.t1649
29+
- cve.2026-54121
30+
logsource:
31+
product: windows
32+
service: security
33+
detection:
34+
selection:
35+
EventID: 4624
36+
TargetUserName|endswith: '$'
37+
TargetUserName|expand: '%dc_machine_accounts%'
38+
filter_main_dc_source:
39+
IpAddress|expand: '%dc_ip_addresses%'
40+
filter_main_loopback:
41+
- IpAddress:
42+
- '127.0.0.1'
43+
- '::1'
44+
- '::ffff:127.0.0.1'
45+
- '-'
46+
- IpAddress|startswith: 'fe80:'
47+
condition: selection and not 1 of filter_main_*
48+
falsepositives:
49+
- Unlikely if %dc_machine_accounts% and %dc_ip_addresses% are correctly populated.
50+
level: critical

‎rules-placeholder/windows/builtin/security/win_security_dc_machine_account_tgs_non_dc_ip.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
title: DC Machine Account TGS Request from Non-DC Source IP
2+
id: e3f7c841-2a9d-4b5e-c018-d94b3e67f012
3+
status: experimental
4+
description: |
5+
Detects a Kerberos service ticket request (Event 4769) targeting a Domain Controller
6+
machine account's service (e.g. DRSUAPI) originating from an IP address that is not a
7+
known Domain Controller. Service tickets for DC machine accounts should only be requested
8+
by other DCs during legitimate replication operations.
9+
10+
An attacker with a valid TGT (obtained via PKINIT, overpass-the-hash, or stolen TGT)
11+
targeting a DC machine account's service from a workstation IP indicates preparation for
12+
DCSync or impersonation of a DC. Unlike Silver Ticket attacks (which forge the TGS and
13+
bypass this event), this rule catches attacks that go through the KDC legitimately.
14+
15+
This rule requires %dc_machine_accounts% and %dc_ip_addresses% to be populated with
16+
all known DC machine account names and DC IP addresses respectively.
17+
references:
18+
- https://github.com/aniqfakhrul/CVE-2026-54121
19+
- https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26
20+
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54121
21+
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4769
22+
author: Swachchhanda Shrawan Poudel (Nextron Systems)
23+
date: 2026-07-29
24+
tags:
25+
- attack.credential-access
26+
- attack.lateral-movement
27+
- attack.t1550.003
28+
- attack.t1558.003
29+
- cve.2026-54121
30+
logsource:
31+
product: windows
32+
service: security
33+
detection:
34+
selection:
35+
EventID: 4769
36+
Status: '0x0'
37+
ServiceName|endswith: '$'
38+
ServiceName|expand: '%dc_machine_accounts%' # should be populated with all known DC machine account names
39+
filter_main_dc_source:
40+
IpAddress|expand: '%dc_ip_addresses%'
41+
filter_main_loopback:
42+
- IpAddress:
43+
- '127.0.0.1'
44+
- '::1'
45+
- '::ffff:127.0.0.1'
46+
- '-'
47+
- IpAddress|startswith: 'fe80:'
48+
condition: selection and not 1 of filter_main_*
49+
falsepositives:
50+
- Unlikely
51+
level: high

‎rules-placeholder/windows/builtin/security/win_security_dc_machine_accoutn_tgt_non_dc_ip.yml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
title: DC Machine Account TGT Request from Non-DC Source IP
2+
id: 9c5d2b84-1f7e-4a3c-d6b8-e04f9a17c523
3+
status: experimental
4+
description: |
5+
Detects a Kerberos TGT request (Event 4768) for a known Domain Controller machine account
6+
originating from an IP address that is not a known Domain Controller. DC machine accounts
7+
should only request TGTs from their own IP. Any TGT request for a DC account from a
8+
workstation or non-DC host is anomalous and indicates one of the following:
9+
10+
- PKINIT abuse (CVE-2026-54121 / Certighost): attacker authenticating as a DC via a
11+
forged certificate from their workstation
12+
- Overpass-the-Hash: attacker converting a stolen DC machine account NTLM hash into a
13+
Kerberos TGT
14+
- Pass-the-Hash (RC4): attacker using the DC machine account hash directly with Kerberos
15+
references:
16+
- https://github.com/aniqfakhrul/CVE-2026-54121
17+
- https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26
18+
author: Swachchhanda Shrawan Poudel (Nextron Systems)
19+
date: 2026-07-29
20+
tags:
21+
- attack.credential-access
22+
- attack.lateral-movement
23+
- attack.t1649
24+
- attack.t1550.003
25+
- attack.t1558.001
26+
- cve.2026-54121
27+
logsource:
28+
product: windows
29+
service: security
30+
detection:
31+
selection:
32+
EventID: 4768
33+
Status: '0x0'
34+
TargetUserName|endswith: '$'
35+
TargetUserName|expand: '%dc_machine_accounts%'
36+
filter_main_dc_source:
37+
IpAddress|expand: '%dc_ip_addresses%'
38+
filter_main_loopback:
39+
- IpAddress:
40+
- '127.0.0.1'
41+
- '::1'
42+
- '::ffff:127.0.0.1'
43+
- '-'
44+
- IpAddress|startswith: 'fe80:'
45+
condition: selection and not 1 of filter_main_*
46+
falsepositives:
47+
- Unlikely if %dc_machine_accounts% and %dc_ip_addresses% are correctly populated.
48+
level: high

‎rules-placeholder/windows/network_connection/net_connection_win_certsvc_outbound_smb_ldap.yml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
title: Certificate Services Outbound SMB or LDAP Connection
2+
id: 2a9e4f17-6c3b-4d8a-e1f0-b57c2d94a631
3+
related:
4+
- id: c4a1f389-2e6b-4d9a-8f0c-b73e5a12d947
5+
type: similar
6+
status: experimental
7+
description: |
8+
Detects the Windows Certificate Services process (certsrv.exe) initiating an outbound
9+
network connection on port 445 (SMB) or 389 (LDAP) to a non-DC host. This behaviour is
10+
inherently suspicious: under normal operation the CA resolves subject identities via local
11+
RPC against the domain and never initiates outbound SMB or LDAP connections to arbitrary
12+
hosts. Any such connection indicates the CA is being coerced into performing a remote
13+
identity lookup against an attacker-controlled host.
14+
15+
The most direct known trigger is the CA chase fallback (EDITF_ENABLECHASECLIENTDC) where
16+
a requester-supplied 'cdc' attribute causes the CA to open SMB and LDAP to a specified
17+
address. CVE-2026-54121 (Certighost) exploits this path to redirect the CA to rogue LSA
18+
and LDAP services that return a DC's identity, resulting in a forged DC certificate.
19+
This rule is not limited to Certighost — any future vulnerability or misconfiguration
20+
that causes certsrv.exe to make outbound SMB or LDAP connections is covered.
21+
references:
22+
- https://github.com/aniqfakhrul/CVE-2026-54121
23+
author: Swachchhanda Shrawan Poudel (Nextron Systems)
24+
date: 2026-07-29
25+
tags:
26+
- attack.privilege-escalation
27+
- attack.credential-access
28+
- attack.t1649
29+
logsource:
30+
category: network_connection
31+
product: windows
32+
detection:
33+
selection:
34+
Image|endswith: '\certsrv.exe'
35+
Initiated: 'true'
36+
DestinationPort:
37+
- 389
38+
- 445
39+
filter_main_loopback:
40+
DestinationIp:
41+
- '127.0.0.1'
42+
- '::1'
43+
- '0:0:0:0:0:0:0:1'
44+
filter_main_known_legit_ips:
45+
DestinationIp|expand: '%legit_ips%' # Including known legitimate IPs for the CA server (e.g. other DCs, LDAP servers, etc.)
46+
condition: selection and not 1 of filter_main_*
47+
falsepositives:
48+
- Unlikely
49+
level: high

0 commit comments

Comments
 (0)