ADCS - Certighost Certificate Issued via CDC Chase (CVE-2026-54121)
Detects successful issuance of an ADCS certificate where the request attributes include 'cdc' (Client DC) or 'rmd' (Remote Domain) pointing to a non-DC domain or IP, confirming the CA's chase fallback path was taken against an attacker-controlled target. 'cdc' directs the CA to an address for identity lookup; 'rmd' specifies the principal to look up there. In an attack (CVE-2026-54121, Certighost), cdc points to a rogue host that returns a forged DC identity. A successfully issued certificate at this stage means the attacker has obtained a cert carrying a Domain Controller's SID and DNS identity, enabling PKINIT authentication as that DC followed by DCSync replication.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.
Definition
This requires two independent controls on the CA server. (1) CA\AuditFilter must have bit 0x04 (AUDIT_CERTSRV_REQUESTFLAGS) set this instructs certsrv.exe to emit request/issuance events. Without this bit the CA never calls ReportEvent() for certificate operations, regardless of OS policy. - Set via: certutil -setreg CA\AuditFilter 127 then net stop CertSvc; net start CertSvc. (2) The OS audit subcategory must be enabled to write those events into the Security log: auditpol /set /subcategory:"Certification Services" /success:enable. Note: GPO alone (without AuditFilter) is not sufficient.
detection:
selection:
EventID: 4887
Attributes|contains:
- 'cdc:'
- 'rmd:'
filter_main_known_cdc_ips:
Attributes|contains|expand: '%known_cdcs%' # should be populated with all known legitimate DC hostnames and IPs
condition: selection and not 1 of filter_main_*False positive likelihood has not been assessed. Additional context may be needed during triage.
Other