ADCS Certificate Database Copied for Offline Forgery
This rule detects attempts to copy the Active Directory Certificate Services (ADCS) certificate database for offline forgery. Specifically, it looks for SMB traffic to a server on port 445 (SMB) containing the string "certnew.cer" (case-insensitive) in the content, indicating a file transfer of a newly issued certificate. This activity is often associated with credential access techniques, where an attacker might exfiltrate certificate data to forge credentials.
Suricata
