Detectionhightest

HackTool - Certipy Execution

Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Martin Mueller, Sittikorn SangrattanapitakCreated Mon Apr 17Updated Tue Oct 086938366d-8954-4ddc-baff-c830b3ba8fcdwindows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_img:
        - Image|endswith: '\Certipy.exe'
        - OriginalFileName: 'Certipy.exe'
        - Description|contains: 'Certipy'
    selection_cli_commands:
        CommandLine|contains:
            - ' account '
            - ' auth '
            # - ' ca ' # Too short to be used with just one CLI
            - ' cert '
            - ' find '
            - ' forge '
            - ' ptt '
            - ' relay '
            - ' req '
            - ' shadow '
            - ' template '
    selection_cli_flags:
        CommandLine|contains:
            - ' -bloodhound'
            - ' -ca-pfx '
            - ' -dc-ip '
            - ' -kirbi'
            - ' -old-bloodhound'
            - ' -pfx '
            - ' -target'
            - ' -template'
            - ' -username '
            - ' -vulnerable'
            - 'auth -pfx'
            - 'shadow auto'
            - 'shadow list'
    condition: selection_img or all of selection_cli_*