AD CS Certificate Request Using Attacker-Controlled cdc/rmd Chase Attributes (CertiGhost)
Detects Active Directory Certificate Services (AD CS) certificate request or issuance events where the request attributes contain 'cdc=' or 'rmd=' parameters. These parameters are indicative of the CertiGhost (CVE-2026-54121) exploit, where an attacker coerces the Certificate Authority to interact with an attacker-controlled LDAP or LSA listener by abusing chase-abuse flows during the certificate request process.
Microsoft Sentinel (KQL)
