Execution of public CertiGhost AD CS exploit tool (certighost.py)

Ethan Andrews@eandrews

•updated Jul 24, 2026•67•0•189

Detects the execution of 'certighost.py', a Python-based tool used to exploit CVE-2026-54121. The detection monitors process command lines for the specific script name in combination with command-line arguments (such as --dc-ip, --template, --computer-name, etc.) used to abuse the AD CS chase enrollment flow for malicious certificate requests.