AD CS Chase Fallback Enrollment Abuse via cdc/rmd Attributes (CVE-2026-54121 Certighost)

Georgios Maragos@Gmarak

•updated Jul 28, 2026•35•1•112

Detects malicious certificate enrollment requests targeting Active Directory Certificate Services (AD CS) that utilize legacy 'cdc' (Client DC) or 'rmd' (Remote Domain) request attributes, a technique associated with the 'Certighost' exploit (CVE-2026-54121). Additionally, the rule monitors the CA process (certsrv.exe) for suspicious outbound SMB or LDAP connections, which may indicate the abuse of AD CS chase fallback logic to coerce authentication.