ADCS - Certighost CDC Chase Certificate Request (CVE-2026-54121)
Detects Active Directory Certificate Services (ADCS) certificate requests that include the 'cdc' (Client DC) request attribute pointing to a domain or IP that is not a known Domain Controller. 'cdc' is an optional MS-WCCE enrollment attribute designed for cross-domain/cross-forest scenarios where a client in a child domain tells the CA which DC to contact for identity lookups when the CA cannot reach that domain directly. Legitimate values are DC hostnames or IPs that resolve to a real Domain Controller computer object in AD with the SERVER_TRUST_ACCOUNT (0x2000) userAccountControl bit set. In an attack, the attacker sets cdc to a domain or IP they control so the CA connects to their rogue SMB and LDAP services instead of a real DC. The rogue server returns a forged DC identity which the pre-patch CA accepts without validation. A malicious event looks like: Requester: DOMAIN\GHOST<random>$ Attributes: cdc:<attacker_ip> rmd:<target_dc_fqdn> SubjectAlternativeName: DNS Name=<target_dc_fqdn> CVE-2026-54121 (Certighost) is the known exploit for this path. The July 2026 patch added _ValidateChaseTargetIsDC which rejects cdc values that do not resolve to a legitimate DC object in Active Directory before following the chase.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.
Definition
This requires two independent controls on the CA server. (1) CA\AuditFilter must have bit 0x04 (AUDIT_CERTSRV_REQUESTFLAGS) set this instructs certsrv.exe to emit request/issuance events. Without this bit the CA never calls ReportEvent() for certificate operations, regardless of OS policy. - Set via: certutil -setreg CA\AuditFilter 127 then net stop CertSvc; net start CertSvc. (2) The OS audit subcategory must be enabled to write those events into the Security log: auditpol /set /subcategory:"Certification Services" /success:enable. Note: GPO alone (without AuditFilter) is not sufficient.
detection:
selection:
EventID: 4886
Attributes|contains: 'cdc:'
filter_main_known_cdc:
Attributes|contains|expand: '%known_cdcs%' # should be populated with all known legitimate DC hostnames and IPs
condition: selection and not 1 of filter_main_*False positive likelihood has not been assessed. Additional context may be needed during triage.
Other
2a9e4f17-6c3b-4d8a-e1f0-b57c2d94a631