ADCSPwn Execution Detection

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•2•0•26

Detects command line parameters used by ADCSPwn, a tool designed to escalate privileges in an Active Directory network. This tool achieves privilege escalation by coercing authentication from machine accounts and relaying it to the certificate service.