Warawut Manosong

@chicken0248

0 followers39 downloads0 copies1 like39 views

1 detection

Filters

Last updated

All Time

Detection languages

Sigma1

Platforms

Windows1

Products / Services

Active Directory Domain Services1

Windows Event Log (Security)1

MITRE Techniques

TA0004 - Privilege Escalation1

TA0006 - Credential Access1

Certipy ESC4 Privilege Escalation with Default Configuration of Certipy

Sigma

Detect possible ADCS ESC4 privilege escalation using Certipy's default template hijacking. This detects a change of the security descriptor on a certificate template granting full control to the Authenticated Users group. Event ID 4886 and 4898 will typically also be generated at the same time. Afterwards, Event ID 4886 and 4887 may appear to indicate a certificate request as a high-privilege user in the UPN field.

Warawut Manosong@chicken0248

Detections.ai Community

1 year ago

0139