Techniques › T1649
T1649 Steal or Forge Authentication Certificates
credential access — Windows, Linux, macOS, Identity Provider · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
11
Sigma rules tagged attack.t1649
0
KEV CVEs mapped here
<p>Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. For example, Entra ID device certificates and Active Directory Certificate Services (AD CS) certificates bind to an identity and can be used as credentials for domain accounts.</p><p>Authentication certificates can be both stolen and forged. For example, AD CS certificates can be stolen from encrypted storage (in the Registry or files), misplaced certificate files (i.e. Unsecured Credentials), or directly from the Windows certificate store via various crypto APIs. With appropriate enrollment rights, users and/or machines within a domain can also request and/or manually renew certificates from enterprise certificate authorities (CA). This enrollment process defines various settings and permissions associated with the certificate. Of note, the certificate’s extended key usage (EKU) values define signing, encryption, and authentication use cases, while the certificate’s subject alternative name (SAN) values define the certificate owner’s alternate names.</p><p>Abusing certificates for authentication credentials may enable other behaviors such as Lateral Movement. Certificate-related misconfigurations may also enable opportunities for Privilege Escalation, by way of allowing users to impersonate or assume privileged accounts or permissions via the identities (SANs) associated with a certificate. These abuses may also enable Persistence via stealing or forging certificates that can be used as Valid Accounts for the duration of the certificate's validity, despite user password resets. Authentication certificates can also be stolen and forged for machine accounts.</p><p>Adversaries who have access to root (or subordinate) CA certificate private keys (or mechanisms protecting/managing these keys) may also establish Persistence by forging arbitrary authentication certificates for the victim domain (known as “golden” certificates). Adversaries may also target certificates and related services in order to access other forms of credentials, such as Golden Ticket ticket-granting tickets (TGT) or NTLM plaintext.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0240 Detection Strategy for Steal or Forge Authentication Certificates v1.0
AN0671 WindowsMonitor for abnormal certificate enrollment and usage activity in Active Directory Certificate Services (AD CS), registry access to certificate storage locations, and unusual process executions that attempt to export or access private keys.Tunable:
EKU_ThresholdsTimeWindowLogonContextAN0672 LinuxMonitor for file access to certificate directories, commands invoking OpenSSL or PKCS#12 utilities to export or modify certificates, and processes accessing sensitive key storage paths.Tunable:PathExclusionsUserContextAN0673 macOSMonitor for security commands and API calls interacting with the Keychain, as well as file access attempts to stored certificates and private keys in ~/Library/Keychains or /Library/Keychains.macos:unifiedlogprocess calling security find-certificate, export, or import→ DC0064 Command ExecutionTunable:ApplicationAllowListAN0674 Identity ProviderMonitor for abnormal certificate enrollment events in identity platforms, unexpected use of token-signing certificates, and unusual CA configuration modifications.azure:signinlogsAdd certificate credential, Update certificate credential→ DC0066 Active Directory Object Modificationm365:unifiedcertificate added or modified in application credentials→ DC0038 Application Log ContentTunable:GeoContextThresholds
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1649
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-07-29 · logsource: product=windows category=network_connection · 2a9e4f17-6c3b-4d8a-e1f0-b57c2d94a631
Detects the Windows Certificate Services process (certsrv.exe) initiating an outbound
network connection on port 445 (SMB) or 389 (LDAP) to a non-DC host. This behaviour is
inherently suspicious: under normal operation the CA resolves subject identities via local
RPC against the domain and never initiates outbound SMB or LDAP connections to arbitrary
hosts. Any such connection indicates the CA is being coerced into performing a remote
identity lookup against an attacker-controlled host.
The most direct known trigger is the CA chase fallback (EDITF_ENABLECHASECLIENTDC) where
a requester-supplied 'cdc' attribute causes the CA to open SMB and LDAP to a specified
address. CVE-2026-54121 (Certighost) exploits this path to redirect the CA to rogue LSA
and LDAP services that return a DC's identity, resulting in a forged DC certificate.
This rule is not limited to Certighost — any future vulnerability or misconfiguration
that causes certsrv.exe to make outbound SMB or LDAP connections is covered.
Author: Zach Mathis
· 2023-05-13 · logsource: product=windows service=certificateservicesclient-lifecycle-system · 58c0bff0-40a0-46e8-b5e8-b734b84d2017
Detects when an application exports a certificate (and potentially the private key as well) from the local Windows certificate store.
Author: pH-T (Nextron Systems), Sittikorn Sangrattanapitak
· 2023-04-17 (modified 2024-10-08) · logsource: product=windows category=process_creation · 6938366d-8954-4ddc-baff-c830b3ba8fcd
Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments.
Author: pH-T (Nextron Systems)
· 2023-04-17 (modified 2023-04-25) · logsource: product=windows category=process_creation · 762f2482-ff21-4970-8939-0aa317a886bb
Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command line arguments.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-07-27 · logsource: product=windows service=security · 8b7e2c54-1f93-4a6d-b8e0-3c9d7f25a168
Detects successful issuance of an ADCS certificate where the request attributes include
'cdc' (Client DC) or 'rmd' (Remote Domain) pointing to a non-DC domain or IP, confirming the
CA's chase fallback path was taken against an attacker-controlled target.
'cdc' directs the CA to an address for identity lookup; 'rmd' specifies the principal to
look up there. In an attack (CVE-2026-54121, Certighost), cdc points to a rogue host that
returns a forged DC identity. A successfully issued certificate at this stage means the
attacker has obtained a cert carrying a Domain Controller's SID and DNS identity, enabling
PKINIT authentication as that DC followed by DCSync replication.
Author: frack113
· 2022-10-14 (modified 2023-12-14) · logsource: product=windows service=security · 94309181-d345-4cbf-b5fe-061769bdf9cb
Detects logon with "Special groups" and "Special Privileges" can be thought of as Administrator groups or privileges.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-07-29 · logsource: product=windows service=security · 9c5d2b84-1f7e-4a3c-d6b8-e04f9a17c523
Detects a Kerberos TGT request (Event 4768) for a known Domain Controller machine account
originating from an IP address that is not a known Domain Controller. DC machine accounts
should only request TGTs from their own IP. Any TGT request for a DC account from a
workstation or non-DC host is anomalous and indicates one of the following:
- PKINIT abuse (CVE-2026-54121 / Certighost): attacker authenticating as a DC via a
forged certificate from their workstation
- Overpass-the-Hash: attacker converting a stolen DC machine account NTLM hash into a
Kerberos TGT
- Pass-the-Hash (RC4): attacker using the DC machine account hash directly with Kerberos
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-07-29 · logsource: product=windows service=security · b2e4a719-3c8f-4d1b-a507-f83c2d56e901
Detects a Domain Controller machine account authenticating from a source IP that is not
a known Domain Controller. DC machine accounts should only authenticate locally or from other DCs during
replication operations. Any logon event for a DC account from a workstation or non-DC host is anomalous and
indicates one of the following:
- Silver Ticket: attacker forged a Kerberos TGS for a DC machine account without
requesting a TGT
- Pass-the-Ticket: attacker is replaying a captured DC machine account TGS from
a non-DC host
- Overpass-the-Hash: attacker converted a stolen DC machine account hash into a
Kerberos ticket and is authenticating from a non-DC host
- Exploitation of certain vulnerabilities such as CVE-2026-54121 (Certighost):
attacker obtained a DC certificate via ADCS CDC-chase
abuse, authenticates via PKINIT as the DC from their own host, then performs DCSync
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-07-27 · logsource: product=windows service=security · c4a1f389-2e6b-4d9a-8f0c-b73e5a12d947
Detects Active Directory Certificate Services (ADCS) certificate requests that include the
'cdc' (Client DC) request attribute pointing to a domain or IP that is not a known Domain Controller.
'cdc' is an optional MS-WCCE enrollment attribute designed for cross-domain/cross-forest
scenarios where a client in a child domain tells the CA which DC to contact for identity
lookups when the CA cannot reach that domain directly. Legitimate values are DC hostnames
or IPs that resolve to a real Domain Controller computer object in AD with the
SERVER_TRUST_ACCOUNT (0x2000) userAccountControl bit set.
In an attack, the attacker sets cdc to a domain or IP they control so the CA connects to their
rogue SMB and LDAP services instead of a real DC. The rogue server returns a forged DC
identity which the pre-patch CA accepts without validation. A malicious event looks like:
Requester: DOMAIN\GHOST<random>$
Attributes: cdc:<attacker_ip>
rmd:<target_dc_fqdn>
SubjectAlternativeName: DNS Name=<target_dc_fqdn>
CVE-2026-54121 (Certighost) is the known exploit for this path. The July 2026 patch added
_ValidateChaseTargetIsDC which rejects cdc values that do not resolve to a legitimate
DC object in Active Directory before following the chase.
Author: Zach Mathis
· 2023-05-13 · logsource: product=windows service=capi2 · e2b5163d-7deb-4566-9af3-40afea6858c3
Detects when an application acquires a certificate private key
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-07-30 · logsource: product=windows service=security · fa0bac5f-d170-4a91-9780-1ad71dc1f49e
Detects the creation of a machine account whose name starts with 'GHOST', which is the
naming convention used by the CVE-2026-54121 (Certighost) exploit tooling.
The public proof-of-concept for Certighost creates a temporary machine account with a
name of the form GHOST<random>$ before enrolling for a DC certificate via the cdc chase
path. The attacker-controlled machine account is used as the requester identity in the
certificate request; the cdc attribute then redirects the CA to a rogue host that returns
a forged Domain Controller identity. The resulting certificate carries the DC's SID and
DNS name, enabling full PKINIT authentication as the targeted DC followed by DCSync.
A machine account creation event (4741) where TargetUserName starts with 'GHOST' and
ends with '$' is a high-fidelity indicator of this attack tool's execution. Legitimate
environments very rarely provision machine accounts with this prefix.