{"id":"T1649","name":"Steal or Forge Authentication Certificates","url":"https://attack.mitre.org/techniques/T1649","tactics":["credential-access"],"platforms":["Windows","Linux","macOS","Identity Provider"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0240","stix_id":"x-mitre-detection-strategy--7b0ea292-22f5-4963-b1c2-0d396fb17619","name":"Detection Strategy for Steal or Forge Authentication Certificates","url":"https://attack.mitre.org/detectionstrategies/DET0240","analytics":[{"id":"AN0671","stix_id":"x-mitre-analytic--c448cbb5-1256-4a00-8582-1759fb5a6e56","name":"Analytic 0671","description":"Monitor for abnormal certificate enrollment and usage activity in Active Directory Certificate Services (AD CS), registry access to certificate storage locations, and unusual process executions that attempt to export or access private keys.","url":"https://attack.mitre.org/detectionstrategies/DET0240#AN0671","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4768","data_component":"DC0084","data_component_name":"Active Directory Credential Request","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Security","channel":"EventCode=4657","data_component":"DC0050","data_component_name":"Windows Registry Key Access","log_source_slug":"wineventlog-security"}],"mutable_elements":[{"field":"EKU_Thresholds","description":"Organizations may tune which Extended Key Usage (EKU) values are considered risky."},{"field":"TimeWindow","description":"Defines how quickly multiple certificate enrollments from the same entity should trigger correlation alerts."},{"field":"LogonContext","description":"Differentiate between service accounts and interactive user accounts to reduce false positives."}],"live":true,"detection_strategies":["DET0240"],"techniques":["T1649"]},{"id":"AN0672","stix_id":"x-mitre-analytic--27cbe2a7-25a0-4f6d-b2b0-dff50b2c0883","name":"Analytic 0672","description":"Monitor for file access to certificate directories, commands invoking OpenSSL or PKCS#12 utilities to export or modify certificates, and processes accessing sensitive key storage paths.","url":"https://attack.mitre.org/detectionstrategies/DET0240#AN0672","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"open, read: /etc/ssl/, /etc/pki/, ~/.pki/nssdb/","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"execve: openssl pkcs12, certutil, keytool","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"PathExclusions","description":"Exempt trusted automated services regularly accessing PKI stores."},{"field":"UserContext","description":"Differentiate root/system accounts versus user-level access to key material."}],"live":true,"detection_strategies":["DET0240"],"techniques":["T1649"]},{"id":"AN0673","stix_id":"x-mitre-analytic--62285936-d8a3-4b18-b3b4-a521fbef10ec","name":"Analytic 0673","description":"Monitor for security commands and API calls interacting with the Keychain, as well as file access attempts to stored certificates and private keys in ~/Library/Keychains or /Library/Keychains.","url":"https://attack.mitre.org/detectionstrategies/DET0240#AN0673","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"process calling security find-certificate, export, or import","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-unifiedlog"},{"name":"macos:keychain","channel":"~/Library/Keychains, /Library/Keychains","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"macos-keychain"}],"mutable_elements":[{"field":"ApplicationAllowList","description":"Whitelist legitimate apps that interact with Keychain to reduce false positives."}],"live":true,"detection_strategies":["DET0240"],"techniques":["T1649"]},{"id":"AN0674","stix_id":"x-mitre-analytic--af8d3a12-dafb-4e40-8017-7d20d9e77d55","name":"Analytic 0674","description":"Monitor for abnormal certificate enrollment events in identity platforms, unexpected use of token-signing certificates, and unusual CA configuration modifications.","url":"https://attack.mitre.org/detectionstrategies/DET0240#AN0674","platforms":["Identity Provider"],"log_source_references":[{"name":"azure:signinlogs","channel":"Add certificate credential, Update certificate credential","data_component":"DC0066","data_component_name":"Active Directory Object Modification","log_source_slug":"azure-signinlogs"},{"name":"m365:unified","channel":"certificate added or modified in application credentials","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"m365-unified"}],"mutable_elements":[{"field":"GeoContext","description":"Detect certificate-related changes occurring from unusual geographic locations."},{"field":"Thresholds","description":"Adjust enrollment/issuance request volume thresholds per tenant size."}],"live":true,"detection_strategies":["DET0240"],"techniques":["T1649"]}],"live":true,"version":"1.0","techniques":["T1649"]}],"sigma_rules":[{"id":"2a9e4f17-6c3b-4d8a-e1f0-b57c2d94a631","title":"Certificate Services Outbound SMB or LDAP Connection","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-07-29","modified":null,"description":"Detects the Windows Certificate Services process (certsrv.exe) initiating an outbound\nnetwork connection on port 445 (SMB) or 389 (LDAP) to a non-DC host. This behaviour is\ninherently suspicious: under normal operation the CA resolves subject identities via local\nRPC against the domain and never initiates outbound SMB or LDAP connections to arbitrary\nhosts. Any such connection indicates the CA is being coerced into performing a remote\nidentity lookup against an attacker-controlled host.\n\nThe most direct known trigger is the CA chase fallback (EDITF_ENABLECHASECLIENTDC) where\na requester-supplied 'cdc' attribute causes the CA to open SMB and LDAP to a specified\naddress. CVE-2026-54121 (Certighost) exploits this path to redirect the CA to rogue LSA\nand LDAP services that return a DC's identity, resulting in a forged DC certificate.\nThis rule is not limited to Certighost — any future vulnerability or misconfiguration\nthat causes certsrv.exe to make outbound SMB or LDAP connections is covered.\n","references":["https://github.com/aniqfakhrul/CVE-2026-54121"],"logsource":{"product":"windows","category":"network_connection"},"tags":["attack.privilege-escalation","attack.credential-access","attack.t1649"],"path":"rules-placeholder/windows/network_connection/net_connection_win_certsvc_outbound_smb_ldap.yml","techniques":["T1649"],"cves":[]},{"id":"58c0bff0-40a0-46e8-b5e8-b734b84d2017","title":"Certificate Exported From Local Certificate Store","author":"Zach Mathis","status":"test","level":"medium","date":"2023-05-13","modified":null,"description":"Detects when an application exports a certificate (and potentially the private key as well) from the local Windows certificate store.","references":["https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html"],"logsource":{"product":"windows","service":"certificateservicesclient-lifecycle-system"},"tags":["attack.credential-access","attack.t1649"],"path":"rules/windows/builtin/certificate_services_client_lifecycle_system/win_certificateservicesclient_lifecycle_system_cert_exported.yml","techniques":["T1649"],"cves":[]},{"id":"6938366d-8954-4ddc-baff-c830b3ba8fcd","title":"HackTool - Certipy Execution","author":"pH-T (Nextron Systems), Sittikorn Sangrattanapitak","status":"test","level":"high","date":"2023-04-17","modified":"2024-10-08","description":"Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments.\n","references":["https://github.com/ly4k/Certipy","https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-gui-new-authentication-and-request-methods-and-more-7237d88061f7"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.credential-access","attack.t1649"],"path":"rules/windows/process_creation/proc_creation_win_hktl_certipy.yml","techniques":["T1649"],"cves":[]},{"id":"762f2482-ff21-4970-8939-0aa317a886bb","title":"HackTool - Certify Execution","author":"pH-T (Nextron Systems)","status":"test","level":"high","date":"2023-04-17","modified":"2023-04-25","description":"Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command line arguments.","references":["https://github.com/GhostPack/Certify"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.credential-access","attack.t1649"],"path":"rules/windows/process_creation/proc_creation_win_hktl_certify.yml","techniques":["T1649"],"cves":[]},{"id":"8b7e2c54-1f93-4a6d-b8e0-3c9d7f25a168","title":"ADCS - Certighost Certificate Issued via CDC Chase (CVE-2026-54121)","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-07-27","modified":null,"description":"Detects successful issuance of an ADCS certificate where the request attributes include\n'cdc' (Client DC) or 'rmd' (Remote Domain) pointing to a non-DC domain or IP, confirming the\nCA's chase fallback path was taken against an attacker-controlled target.\n\n'cdc' directs the CA to an address for identity lookup; 'rmd' specifies the principal to\nlook up there. In an attack (CVE-2026-54121, Certighost), cdc points to a rogue host that\nreturns a forged DC identity. A successfully issued certificate at this stage means the\nattacker has obtained a cert carrying a Domain Controller's SID and DNS identity, enabling\nPKINIT authentication as that DC followed by DCSync replication.\n","references":["https://github.com/aniqfakhrul/CVE-2026-54121","https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26"],"logsource":{"product":"windows","service":"security"},"tags":["attack.privilege-escalation","attack.credential-access","attack.t1649","cve.2026-54121","detection.emerging-threats"],"path":"rules-emerging-threats/2026/Exploits/CVE-2026-54121/win_security_adcs_certighost_cert_issued_via_chase.yml","techniques":["T1649"],"cves":["CVE-2026-54121"]},{"id":"94309181-d345-4cbf-b5fe-061769bdf9cb","title":"User with Privileges Logon","author":"frack113","status":"test","level":"low","date":"2022-10-14","modified":"2023-12-14","description":"Detects logon with \"Special groups\" and \"Special Privileges\" can be thought of as Administrator groups or privileges.","references":["https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md","https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4672","https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4964"],"logsource":{"product":"windows","service":"security"},"tags":["attack.lateral-movement","attack.credential-access","attack.t1558","attack.t1649","attack.t1550"],"path":"rules-placeholder/windows/builtin/security/win_security_admin_logon.yml","techniques":["T1558","T1649","T1550"],"cves":[]},{"id":"9c5d2b84-1f7e-4a3c-d6b8-e04f9a17c523","title":"DC Machine Account TGT Request from Non-DC Source IP","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-07-29","modified":null,"description":"Detects a Kerberos TGT request (Event 4768) for a known Domain Controller machine account\noriginating from an IP address that is not a known Domain Controller. DC machine accounts\nshould only request TGTs from their own IP. Any TGT request for a DC account from a\nworkstation or non-DC host is anomalous and indicates one of the following:\n\n  - PKINIT abuse (CVE-2026-54121 / Certighost): attacker authenticating as a DC via a\n    forged certificate from their workstation\n  - Overpass-the-Hash: attacker converting a stolen DC machine account NTLM hash into a\n    Kerberos TGT\n  - Pass-the-Hash (RC4): attacker using the DC machine account hash directly with Kerberos\n","references":["https://github.com/aniqfakhrul/CVE-2026-54121","https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26"],"logsource":{"product":"windows","service":"security"},"tags":["attack.credential-access","attack.lateral-movement","attack.t1649","attack.t1550.003","attack.t1558.001","cve.2026-54121"],"path":"rules-placeholder/windows/builtin/security/win_security_dc_machine_accoutn_tgt_non_dc_ip.yml","techniques":["T1649","T1550.003","T1558.001"],"cves":["CVE-2026-54121"]},{"id":"b2e4a719-3c8f-4d1b-a507-f83c2d56e901","title":"DC Machine Account Network Logon from Non-DC Source IP","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"critical","date":"2026-07-29","modified":null,"description":"Detects a Domain Controller machine account authenticating from a source IP that is not\na known Domain Controller. DC machine accounts should only authenticate locally or from other DCs during\nreplication operations. Any logon event for a DC account from a workstation or non-DC host is anomalous and\nindicates one of the following:\n\n  - Silver Ticket: attacker forged a Kerberos TGS for a DC machine account without\n    requesting a TGT\n  - Pass-the-Ticket: attacker is replaying a captured DC machine account TGS from\n    a non-DC host\n  - Overpass-the-Hash: attacker converted a stolen DC machine account hash into a\n    Kerberos ticket and is authenticating from a non-DC host\n  - Exploitation of certain vulnerabilities such as CVE-2026-54121 (Certighost):\n    attacker obtained a DC certificate via ADCS CDC-chase\n    abuse, authenticates via PKINIT as the DC from their own host, then performs DCSync\n","references":["https://github.com/aniqfakhrul/CVE-2026-54121"],"logsource":{"product":"windows","service":"security"},"tags":["attack.credential-access","attack.lateral-movement","attack.t1550.003","attack.t1558.002","attack.t1649","cve.2026-54121"],"path":"rules-placeholder/windows/builtin/security/win_security_dc_machine_account_logon_non_dc_ip.yml","techniques":["T1550.003","T1558.002","T1649"],"cves":["CVE-2026-54121"]},{"id":"c4a1f389-2e6b-4d9a-8f0c-b73e5a12d947","title":"ADCS - Certighost CDC Chase Certificate Request (CVE-2026-54121)","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-07-27","modified":null,"description":"Detects Active Directory Certificate Services (ADCS) certificate requests that include the\n'cdc' (Client DC) request attribute pointing to a domain or IP that is not a known Domain Controller.\n\n'cdc' is an optional MS-WCCE enrollment attribute designed for cross-domain/cross-forest\nscenarios where a client in a child domain tells the CA which DC to contact for identity\nlookups when the CA cannot reach that domain directly. Legitimate values are DC hostnames\nor IPs that resolve to a real Domain Controller computer object in AD with the\nSERVER_TRUST_ACCOUNT (0x2000) userAccountControl bit set.\n\nIn an attack, the attacker sets cdc to a domain or IP they control so the CA connects to their\nrogue SMB and LDAP services instead of a real DC. The rogue server returns a forged DC\nidentity which the pre-patch CA accepts without validation. A malicious event looks like:\n\n    Requester: DOMAIN\\GHOST<random>$\n    Attributes: cdc:<attacker_ip>\n                rmd:<target_dc_fqdn>\n    SubjectAlternativeName: DNS Name=<target_dc_fqdn>\n\nCVE-2026-54121 (Certighost) is the known exploit for this path. The July 2026 patch added\n_ValidateChaseTargetIsDC which rejects cdc values that do not resolve to a legitimate\nDC object in Active Directory before following the chase.\n","references":["https://github.com/aniqfakhrul/CVE-2026-54121","https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26"],"logsource":{"product":"windows","service":"security"},"tags":["attack.privilege-escalation","attack.credential-access","attack.t1649","cve.2026-54121","detection.emerging-threats"],"path":"rules-emerging-threats/2026/Exploits/CVE-2026-54121/win_security_adcs_certighost_cdc_chase_request.yml","techniques":["T1649"],"cves":["CVE-2026-54121"]},{"id":"e2b5163d-7deb-4566-9af3-40afea6858c3","title":"Certificate Private Key Acquired","author":"Zach Mathis","status":"test","level":"medium","date":"2023-05-13","modified":null,"description":"Detects when an application acquires a certificate private key","references":["https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html"],"logsource":{"product":"windows","service":"capi2"},"tags":["attack.credential-access","attack.t1649"],"path":"rules/windows/builtin/capi2/win_capi2_acquire_certificate_private_key.yml","techniques":["T1649"],"cves":[]},{"id":"fa0bac5f-d170-4a91-9780-1ad71dc1f49e","title":"ADCS - Certighost Ghost Machine Account Creation","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-07-30","modified":null,"description":"Detects the creation of a machine account whose name starts with 'GHOST', which is the\nnaming convention used by the CVE-2026-54121 (Certighost) exploit tooling.\n\nThe public proof-of-concept for Certighost creates a temporary machine account with a\nname of the form GHOST<random>$ before enrolling for a DC certificate via the cdc chase\npath. The attacker-controlled machine account is used as the requester identity in the\ncertificate request; the cdc attribute then redirects the CA to a rogue host that returns\na forged Domain Controller identity. The resulting certificate carries the DC's SID and\nDNS name, enabling full PKINIT authentication as the targeted DC followed by DCSync.\n\nA machine account creation event (4741) where TargetUserName starts with 'GHOST' and\nends with '$' is a high-fidelity indicator of this attack tool's execution. Legitimate\nenvironments very rarely provision machine accounts with this prefix.\n","references":["https://github.com/aniqfakhrul/CVE-2026-54121","https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26"],"logsource":{"product":"windows","service":"security"},"tags":["attack.privilege-escalation","attack.credential-access","attack.persistence","attack.t1136.002","attack.t1649","cve.2026-54121","detection.emerging-threats"],"path":"rules-emerging-threats/2026/Exploits/CVE-2026-54121/win_security_adcs_certighost_ghost_machine_account_creation.yml","techniques":["T1136.002","T1649"],"cves":["CVE-2026-54121"]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}