Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
5
2
1
Contributors
4
1
1
1
1
Categories
3
3
2
2
1
Platforms
8
Products / Services
5
4
2
1
1
MITRE Techniques
5
3
2
2
1
CVEs
71
71
64
58
49
Detects suspicious Active Directory Replication Service (ADRS) requests originating from
a machine account (SubjectUserName ending in '$') rather than a legitimate Domain Controller.
Under normal operation, only Domain Controllers initiate replication requests carrying the
DS-Replication-Get-Changes-All right. If a threat actor obtains valid machine account
credentials — for example by abusing certificate-based authentication (PKINIT) to
impersonate a DC after exploiting a CA vulnerability such as CVE-2026-54121 (Certighost),
where a temporary machine account is created to request a DC certificate and then used to
perform DCSync — they can dump all domain credential material including the krbtgt hash.
a machine account (SubjectUserName ending in '$') rather than a legitimate Domain Controller.
Under normal operation, only Domain Controllers initiate replication requests carrying the
DS-Replication-Get-Changes-All right. If a threat actor obtains valid machine account
credentials — for example by abusing certificate-based authentication (PKINIT) to
impersonate a DC after exploiting a CA vulnerability such as CVE-2026-54121 (Certighost),
where a temporary machine account is created to request a DC certificate and then used to
perform DCSync — they can dump all domain credential material including the krbtgt hash.
Detects Defender XDR alerts and evidence potentially related to Certighost / CVE-2026-54121 AD CS abuse, including suspicious certificate requests, Kerberos activity, LDAP security principal anomalies, and possible DCSync or directory replication abuse.
Detects malicious certificate enrollment requests targeting Active Directory Certificate Services (AD CS) that utilize legacy 'cdc' (Client DC) or 'rmd' (Remote Domain) request attributes, a technique associated with the 'Certighost' exploit (CVE-2026-54121). Additionally, the rule monitors the CA process (certsrv.exe) for suspicious outbound SMB or LDAP connections, which may indicate the abuse of AD CS chase fallback logic to coerce authentication.
Detects the execution of 'certighost.py', a Python-based tool used to exploit CVE-2026-54121. The detection monitors process command lines for the specific script name in combination with command-line arguments (such as --dc-ip, --template, --computer-name, etc.) used to abuse the AD CS chase enrollment flow for malicious certificate requests.
Detects anomalous certificate issuance via Active Directory Certificate Services (AD CS) where a machine-template certificate is issued to a non-computer requester, but the issued certificate's Subject Alternative Name contains a dNSHostName identifier associated with a Domain Controller. This pattern matches the exploitation of the 'CertiGhost' vulnerability (CVE-2026-54121), which allows unauthorized entities to obtain certificates masquerading as Domain Controllers for potential Kerberos authentication abuse.
Detects Active Directory Certificate Services (AD CS) certificate request or issuance events where the request attributes contain 'cdc=' or 'rmd=' parameters. These parameters are indicative of the CertiGhost (CVE-2026-54121) exploit, where an attacker coerces the Certificate Authority to interact with an attacker-controlled LDAP or LSA listener by abusing chase-abuse flows during the certificate request process.
PKINIT DC Impersonation from Non-DC Host
Cortex XDR
This rule detects potential Kerberos PKINIT (Pre-Authentication Type 16) authentication requests where a Domain Controller account (identified via User Account Control bit 8192) is targeted by an authentication attempt originating from a non-DC client address. This behavior may indicate an attempt to impersonate or misuse a high-privilege account for lateral movement or persistence.
Detects Active Directory replication requests (DsGetNcChanges) performed by accounts not identified as Domain Controllers. This behavior is indicative of a DCSync attack, where an adversary uses the directory replication API to extract credentials from Active Directory, potentially leveraging exploited computer accounts.