Potential CertiGhost AD CS Machine Identity Mismatch (CVE-2026-54121)

  1[metadata]
  2creation_date = "2026/08/12"
  3integration = ["system"]
  4maturity = "production"
  5updated_date = "2026/08/12"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies successful Active Directory Certificate Services (AD CS) certificate issuance events where a machine-account
 11requester differs from the Remote Machine Discovery (RMD) chase target while the event's DNS subject alternative name
 12(SAN) matches that target. This requester-to-target mismatch may indicate CertiGhost (CVE-2026-54121) or similar abuse
 13of AD CS request-context chase processing.
 14"""
 15from = "now-9m"
 16language = "esql"
 17license = "Elastic License v2"
 18name = "Potential CertiGhost AD CS Machine Identity Mismatch (CVE-2026-54121)"
 19references = [
 20    "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54121",
 21    "https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26",
 22    "https://github.com/aniqfakhrul/CVE-2026-54121",
 23]
 24risk_score = 73
 25rule_id = "2985ea6e-5b1e-4845-9a57-95f7f78b35f1"
 26severity = "high"
 27tags = [
 28    "Domain: Endpoint",
 29    "Domain: Identity",
 30    "OS: Windows",
 31    "Use Case: Threat Detection",
 32    "Tactic: Credential Access",
 33    "Tactic: Privilege Escalation",
 34    "Use Case: Active Directory Monitoring",
 35    "Use Case: Vulnerability",
 36    "Data Source: Active Directory",
 37    "Data Source: Windows Security Event Logs",
 38    "Resources: Investigation Guide",
 39]
 40timestamp_override = "event.ingested"
 41type = "esql"
 42
 43query = '''
 44FROM logs-system.security-* METADATA _id, _index, _version
 45| WHERE event.code == "4887" AND
 46    winlog.event_data.Requester LIKE "*$" AND
 47    winlog.event_data.Attributes IS NOT NULL
 48
 49// Parse Attributes for RMD and CDC, and as a fallback when dedicated template or SAN fields are absent.
 50// CDC and the effective template are retained for triage purposes
 51| GROK winlog.event_data.Attributes
 52    """(?im)^[ \t]*CertificateTemplate[ \t]*:[ \t]*(?<Esql.attributes_certificate_template>[^\r\n]+)\r?$"""
 53| GROK winlog.event_data.Attributes
 54    """(?im)^[ \t]*SAN[ \t]*:[ \t]*dns[ \t]*=[ \t]*(?<Esql.attributes_san_value>[^\r\n]+)\r?$"""
 55| GROK winlog.event_data.SubjectAlternativeName
 56    """(?im)^[ \t]*DNS[ \t]+Name[ \t]*=[ \t]*(?<Esql.event_san_value>[^\r\n]+)\r?$"""
 57| GROK winlog.event_data.Attributes
 58    """(?im)^[ \t]*cdc[ \t]*:[ \t]*(?<Esql.cdc_value>[^\r\n]+)\r?$"""
 59| GROK winlog.event_data.Attributes
 60    """(?im)^[ \t]*rmd[ \t]*:[ \t]*(?<Esql.rmd_value>[^\r\n]+)\r?$"""
 61| EVAL Esql.effective_certificate_template = TRIM(COALESCE(
 62         winlog.event_data.CertificateTemplate,
 63         Esql.attributes_certificate_template
 64       )),
 65       Esql.san_value = TRIM(COALESCE(Esql.event_san_value, Esql.attributes_san_value)),
 66       Esql.cdc_value = TRIM(Esql.cdc_value),
 67       Esql.rmd_value = TRIM(Esql.rmd_value),
 68       Esql.normalized_requester = TO_LOWER(
 69         REPLACE(winlog.event_data.Requester, """^.*\\|\$$""", "")
 70       ),
 71       Esql.normalized_san_value = TO_LOWER(
 72         REPLACE(Esql.san_value, """\.$""", "")
 73       ),
 74       Esql.normalized_rmd_value = TO_LOWER(
 75         REPLACE(Esql.rmd_value, """\.$""", "")
 76       )
 77// Preserve IP-shaped values; shorten other SAN and RMD values to the first DNS label for machine-account comparison.
 78| EVAL Esql.san_is_ip_shaped =
 79          Esql.normalized_san_value RLIKE """[0-9]{1,3}(\.[0-9]{1,3}){3}""" OR Esql.normalized_san_value LIKE "*:*",
 80       Esql.rmd_is_ip_shaped =
 81          Esql.normalized_rmd_value RLIKE """[0-9]{1,3}(\.[0-9]{1,3}){3}""" OR Esql.normalized_rmd_value LIKE "*:*"
 82| EVAL Esql.normalized_san_target = CASE(
 83         Esql.san_is_ip_shaped,
 84         Esql.normalized_san_value,
 85         REPLACE(Esql.normalized_san_value, """\..*$""", "")
 86       ),
 87       Esql.normalized_rmd_target = CASE(
 88         Esql.rmd_is_ip_shaped,
 89         Esql.normalized_rmd_value,
 90         REPLACE(Esql.normalized_rmd_value, """\..*$""", "")
 91       )
 92| WHERE Esql.normalized_requester IS NOT NULL AND
 93    Esql.normalized_san_target IS NOT NULL AND
 94    Esql.normalized_rmd_target IS NOT NULL
 95| WHERE Esql.normalized_requester != Esql.normalized_rmd_target AND
 96    Esql.normalized_san_target == Esql.normalized_rmd_target
 97| KEEP @timestamp, _id, _index, _version, event.code, event.action, event.category, event.type, event.outcome,
 98    event.created, event.ingested, data_stream.dataset, data_stream.namespace, host.id, host.name,
 99    winlog.computer_name, winlog.record_id, winlog.event_data.RequestId, winlog.event_data.Requester,
100    winlog.event_data.CertificateTemplate, winlog.event_data.Subject, winlog.event_data.SubjectAlternativeName,
101    winlog.event_data.Attributes, winlog.event_data.Disposition, winlog.event_data.SubjectKeyIdentifier,
102    Esql.effective_certificate_template, Esql.san_value, Esql.cdc_value, Esql.rmd_value,
103    Esql.normalized_requester, Esql.normalized_san_target, Esql.normalized_rmd_target
104'''
105
106setup = """## Setup
107
108Audit Certification Services must be enabled on enterprise certification authorities so that successful certificate
109issuance generates Security event 4887.
110
111The Windows Security integration must retain `winlog.event_data.Attributes`, including the requested SAN and chase
112attributes. The rule prefers dedicated certificate-template and subject-alternative-name fields when present and uses
113`Attributes` as a fallback. Dropped, truncated, or rewritten attributes create a visibility gap and do not indicate
114benign activity.
115
116Setup instructions: https://ela.st/audit-certification-services
117"""
118
119note = """## Triage and analysis
120
121### Investigating Potential CertiGhost AD CS Machine Identity Mismatch (CVE-2026-54121)
122
123#### Possible investigation steps
124
125- Does the matched AD CS issuance record validate the identity mismatch?
126  - Focus: `event.code`, `winlog.event_data.RequestId`, `winlog.event_data.Requester`, `Esql.san_value`, `Esql.rmd_value`
127  - Hint: Reopen the Windows Security 4887 record on the same CA host and request ID. Compare the parsed SAN and RMD with the complete `winlog.event_data.Attributes` and dedicated SAN field; additional SAN values or disagreement keep the case unresolved. $investigate_0
128  - Implication: Event 4887 proves successful issuance, and the alert establishes that the requester differs from the RMD target while the parsed SAN matches that target. This is an operational anti-pattern. Close as benign only when CA records and test records identify an authorized CertiGhost or AD CS security test matching the exact CA, request ID, requester, target, template, and time.
129- What identity and authentication capability did the issued certificate receive?
130  - Focus: `Esql.effective_certificate_template`, `winlog.event_data.Subject`, `winlog.event_data.SubjectAlternativeName`, `winlog.event_data.SubjectKeyIdentifier`
131  - Hint: Retrieve the issued certificate and CA request/template configuration for the same request ID. Inspect the certificate's actual subject, SAN, EKUs or application policies, validity and revocation state, and the template's subject-name settings and enrollment permissions.
132  - Implication: Event 4887 and the template name alone do not establish the complete certificate contents or authentication capability. A certificate that represents the RMD target and permits authentication increases the likelihood and impact of credential abuse. Missing certificate or template configuration is unresolved, not benign.
133- What other issuances by the requester appear on the same CA host?
134  - Focus: `host.id`, `winlog.event_data.Requester`, `winlog.event_data.RequestId`, `winlog.event_data.Attributes`, `winlog.event_data.SubjectAlternativeName`
135  - Hint: Recover 4887 events for the same requester on this CA host. $investigate_1
136  - Implication: Repeated successful requests for different SAN/RMD targets expand the potential abuse scope. One isolated request does not reduce the significance of the current mismatch.
137- What other CA events reference the same target identity?
138  - Focus: `Esql.san_value`, `Esql.rmd_value`, `winlog.event_data.Attributes`, `winlog.event_data.SubjectAlternativeName`, `winlog.event_data.Requester`
139  - Hint: Copy the alert's exact SAN and RMD values into a scoped Timeline or Discover search for raw 4886, 4887, and 4888 records on the same CA host. Use contains or wildcard matching against `winlog.event_data.Attributes` and `winlog.event_data.SubjectAlternativeName`; derived `Esql.*` fields exist only on the alert.
140  - Implication: Requests for the same target from additional unexpected accounts expand the affected scope. The absence of other matching events does not clear the current issuance.
141- Did the CA connect to the CDC value during certificate processing?
142  - Focus: `host.id`, `Esql.cdc_value`, `destination.ip`, `destination.port`, `process.name`
143  - Hint: When the CDC value is an IP address, search network events from the CA host around issuance for that `destination.ip`. For a hostname, resolve it from collected DNS or asset evidence before comparing destination IPs. Review LDAP or LDAPS from `certsrv.exe` and SMB from `System` without requiring either process for all callback traffic.
144  - Implication: CA-host LDAP or SMB traffic to the CDC value supports request-context chase activity, but neither the CDC attribute nor a connection alone proves exploitation. Missing DNS or CA network telemetry is unresolved, not benign.
145- Does surrounding activity show requester creation or target-certificate use?
146  - Focus: `event.code`, `winlog.event_data.Requester`, `Esql.normalized_rmd_target`, `winlog.event_data.TargetUserName`, `winlog.event_data.PreAuthType`
147  - Hint: After validating the issuance, inspect account-management events where `winlog.event_data.TargetUserName` matches the requester account name without its domain prefix. Inspect successful 4768 events with `winlog.event_data.PreAuthType` equal to `16`. For DNS-shaped RMD values, compare `winlog.event_data.TargetUserName` with the normalized RMD target plus `$`; for IP-shaped values, first resolve the associated computer account from AD, asset, or CA evidence. Treat later authentication as corroboration unless identity and certificate evidence establish the relationship.
148  - Implication: Requester creation or change followed by target PKINIT strengthens the exploitation hypothesis. Missing account-management or domain-controller authentication telemetry is unresolved, not benign.
149
150Escalate when the mismatch is not an authorized test, the issued certificate can authenticate as the target, or callback and follow-on evidence corroborate abuse. Close only when CA, certificate, and test records establish the exact authorized scope; preserve and escalate when evidence or visibility is mixed or incomplete.
151
152### False positive analysis
153
154The detected requester-to-target relationship is an operational anti-pattern and did not appear in the self-aligned enrollment controls. Authorized CertiGhost or AD CS security testing is the only currently validated benign explanation. Treat other claimed cross-identity enrollment workflows as unresolved until the 4887 source event, CA request record, issued certificate, template configuration, requester, target, CA, and time scope align without contradictions.
155
156Do not close on recurrence, absence of related alerts, or the requester account name alone. ES|QL fields created by the query cannot be used in rule exceptions. If an exception is required for recurring authorized testing, combine narrowly scoped source fields such as the CA `host.id`, `winlog.event_data.Requester`, and the exact `winlog.event_data.Attributes` pattern. Avoid exceptions based only on a host, requester, or template.
157
158### Response and remediation
159
160- Preserve the 4887 source record, CA request and database records, issued certificate and identifiers, template configuration, and relevant authentication and network evidence before disruptive action.
161- Identify affected certification authorities and apply the Microsoft security update or mitigation for CVE-2026-54121. Review request history for the requester and target to identify additional certificates requiring action.
162- If malicious activity is confirmed, revoke the affected certificate and verify that revocation information is distributed. Disable or remove an attacker-controlled requester account after preserving evidence. Rotate the target machine credentials and invalidate affected authentication material when certificate use or impersonation is established.
163- Isolate an endpoint only when host evidence attributes compromise to that system. The requester account may not map to a managed endpoint, and the target identity alone does not prove that the target endpoint was compromised.
164- Record confirmed certificate identifiers, affected principals, CA configuration gaps, and telemetry gaps for the responsible response, PKI, identity, and detection owners.
165"""
166[rule.investigation_fields]
167field_names = [
168    "@timestamp",
169    "event.code",
170    "host.id",
171    "host.name",
172    "winlog.computer_name",
173    "winlog.record_id",
174    "winlog.event_data.RequestId",
175    "winlog.event_data.Requester",
176    "winlog.event_data.CertificateTemplate",
177    "winlog.event_data.Subject",
178    "winlog.event_data.SubjectAlternativeName",
179    "winlog.event_data.Attributes",
180    "winlog.event_data.Disposition",
181    "winlog.event_data.SubjectKeyIdentifier",
182    "Esql.effective_certificate_template",
183    "Esql.san_value",
184    "Esql.rmd_value",
185    "Esql.cdc_value",
186    "Esql.normalized_requester",
187    "Esql.normalized_san_target",
188    "Esql.normalized_rmd_target",
189]
190
191[[transform.investigate]]
192label = "Matched certificate issuance"
193description = "Finds the Windows Security 4887 certificate issuance record on the same CA host and request ID."
194providers = [[
195    { excluded = false, field = "event.code", queryType = "phrase", value = "4887", valueType = "string" },
196    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
197    { excluded = false, field = "winlog.event_data.RequestId", queryType = "phrase", value = "{{winlog.event_data.RequestId}}", valueType = "string" },
198]]
199relativeFrom = "now-24h"
200relativeTo = "now"
201
202[[transform.investigate]]
203label = "Same requester issuances"
204description = "Finds successful certificate issuance events for the same requester on the same CA host."
205providers = [[
206    { excluded = false, field = "event.code", queryType = "phrase", value = "4887", valueType = "string" },
207    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
208    { excluded = false, field = "winlog.event_data.Requester", queryType = "phrase", value = "{{winlog.event_data.Requester}}", valueType = "string" },
209]]
210relativeFrom = "now-7d"
211relativeTo = "now"
212
213
214[[rule.threat]]
215framework = "MITRE ATT&CK"
216[[rule.threat.technique]]
217id = "T1649"
218name = "Steal or Forge Authentication Certificates"
219reference = "https://attack.mitre.org/techniques/T1649/"
220
221[[rule.threat.technique]]
222id = "T1212"
223name = "Exploitation for Credential Access"
224reference = "https://attack.mitre.org/techniques/T1212/"
225
226
227[rule.threat.tactic]
228id = "TA0006"
229name = "Credential Access"
230reference = "https://attack.mitre.org/tactics/TA0006/"
231[[rule.threat]]
232framework = "MITRE ATT&CK"
233[[rule.threat.technique]]
234id = "T1068"
235name = "Exploitation for Privilege Escalation"
236reference = "https://attack.mitre.org/techniques/T1068/"
237
238
239[rule.threat.tactic]
240id = "TA0004"
241name = "Privilege Escalation"
242reference = "https://attack.mitre.org/tactics/TA0004/"