Sigma

Potential Arbitrary File Download Using Office Application

Sep 25, 2026 · attack.stealth attack.t1202 ·

Detects potential arbitrary file download using a Microsoft Office application

Sep 1, 2026 · attack.initial-access attack.t1190 attack.reconnaissance attack.t1595.002 ·

Share on:

ADCS - Certighost CDC Chase Certificate Request (CVE-2026-54121)

Aug 5, 2026 · attack.privilege-escalation attack.credential-access attack.t1649 cve.2026-54121 detection.emerging-threats ·

Share on:

Detects Active Directory Certificate Services (ADCS) certificate requests that include the 'cdc' (Client DC) request attribute pointing to a domain or IP that is not a known Domain Controller.

'cdc' is an optional MS-WCCE enrollment attribute designed for cross-domain/cross-forest scenarios where a client in a child domain tells the CA which DC to contact for identity lookups when the CA cannot reach that domain directly. Legitimate values are DC hostnames or IPs that resolve to a real Domain Controller computer object in AD with the SERVER_TRUST_ACCOUNT (0x2000) userAccountControl bit set.

In an attack, the attacker sets cdc to a domain or IP they control so the CA connects to their rogue SMB and LDAP services instead of a real DC. The rogue server returns a forged DC identity which the pre-patch CA accepts without validation. A malicious event looks like:

Requester: DOMAIN\GHOST<random>$
Attributes: cdc:<attacker_ip>
            rmd:<target_dc_fqdn>
SubjectAlternativeName: DNS Name=<target_dc_fqdn>

CVE-2026-54121 (Certighost) is the known exploit for this path. The July 2026 patch added _ValidateChaseTargetIsDC which rejects cdc values that do not resolve to a legitimate DC object in Active Directory before following the chase.

ADCS - Certighost Certificate Issued via CDC Chase (CVE-2026-54121)

Aug 5, 2026 · attack.privilege-escalation attack.credential-access attack.t1649 cve.2026-54121 detection.emerging-threats ·

Share on:

Detects successful issuance of an ADCS certificate where the request attributes include 'cdc' (Client DC) or 'rmd' (Remote Domain) pointing to a non-DC domain or IP, confirming the CA's chase fallback path was taken against an attacker-controlled target.

'cdc' directs the CA to an address for identity lookup; 'rmd' specifies the principal to look up there. In an attack (CVE-2026-54121, Certighost), cdc points to a rogue host that returns a forged DC identity. A successfully issued certificate at this stage means the attacker has obtained a cert carrying a Domain Controller's SID and DNS identity, enabling PKINIT authentication as that DC followed by DCSync replication.

ADCS - Certighost Ghost Machine Account Creation

Aug 5, 2026 · attack.privilege-escalation attack.credential-access attack.persistence attack.t1136.002 attack.t1649 cve.2026-54121 detection.emerging-threats ·

Share on:

Detects the creation of a machine account whose name starts with 'GHOST', which is the naming convention used by the CVE-2026-54121 (Certighost) exploit tooling.

The public proof-of-concept for Certighost creates a temporary machine account with a name of the form GHOST$ before enrolling for a DC certificate via the cdc chase path. The attacker-controlled machine account is used as the requester identity in the certificate request; the cdc attribute then redirects the CA to a rogue host that returns a forged Domain Controller identity. The resulting certificate carries the DC's SID and DNS name, enabling full PKINIT authentication as the targeted DC followed by DCSync.

A machine account creation event (4741) where TargetUserName starts with 'GHOST' and ends with '$' is a high-fidelity indicator of this attack tool's execution. Legitimate environments very rarely provision machine accounts with this prefix.

Suspicious Machine Account Replication - DcSync Indicator

Aug 5, 2026 · attack.credential-access attack.s0002 attack.t1003.006 cve.2026-54121 ·

ASLR Disabled Via Sysctl or Direct Syscall - Linux

Apr 28, 2026 · attack.privilege-escalation attack.stealth attack.defense-impairment attack.t1685 attack.t1055.009 ·

Share on:

Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:

Use of the personality syscall with the ADDR_NO_RANDOMIZE flag (0x0040000)
Modification of the /proc/sys/kernel/randomize_va_space file
Execution of the sysctl command to set kernel.randomize_va_space=0 Disabling ASLR is often used by attackers during exploit development or to bypass memory protection mechanisms. A successful use of these methods can reduce the effectiveness of ASLR and make memory corruption attacks more reliable.

Event ID 441: The package deployment operation is blocked by the "Allow deployment operations in special profiles" policy
Event ID 442: Deployments to non-system volumes are blocked by the "Disable deployment of Windows Store apps to non-system volumes" policy."
Event ID 453: Package blocked by a platform policy.
Event ID 454: Package blocked by a platform policy.

Share on:

Detects potential abuse of WerFaultSecure.exe to dump Protected Process Light (PPL) processes like LSASS or to freeze security solutions (EDR/antivirus). This technique is used by tools such as EDR-Freeze and WSASS to bypass PPL protections and access sensitive information or disable security software. Distinct command line patterns help identify the specific tool:

WSASS usage typically shows: "WSASS.exe WerFaultSecure.exe [PID]" in ParentCommandLine
EDR-Freeze usage typically shows: "EDR-Freeze_[version].exe [PID] [timeout]" in ParentCommandLine Legitimate debugging operations using WerFaultSecure are rare in production environments and should be investigated.

RedSun - Conhost.exe Spawned by TieringEngineService.exe

Apr 28, 2026 · attack.privilege-escalation attack.stealth attack.t1134.002 attack.t1036.005 detection.emerging-threats ·

Share on:

Detects two stages of the RedSun post-exploitation process chain that deliver a SYSTEM-level shell to the attacker's interactive session. Observed process chain services.exe → TieringEngineService.exe → conhost.exe (SYSTEM, CommandLine: bare path, no arguments) → cmd.exe / shell (SYSTEM, TerminalSessionId = attacker's session)

Stage 1 — TieringEngineService.exe spawns argument-less conhost.exe: After winning the oplock + Cloud Files mount point race, the malicious TieringEngineService.exe (RedSun.exe copied to System32, started via CoCreateInstance / services.exe) detects it is NT AUTHORITY\SYSTEM and calls LaunchConsoleInSessionId(). This opens \.\pipe\REDSUN, reads the attacker's session ID, duplicates the SYSTEM token, re-stamps it with that session ID via SetTokenInformation(TokenSessionId), then calls CreateProcessAsUser to spawn conhost.exe with no arguments.

Stage 2 — Shell spawned from rogue conhost.exe (EDR sources with GrandParentImage): The rogue SYSTEM conhost.exe spawns a shell (cmd.exe, PowerShell, etc.) as SYSTEM in the attacker's interactive session. On EDR sources that expose GrandParentImage, the full three-level chain (TieringEngineService.exe → conhost.exe → shell) can be matched directly. The legitimate TieringEngineService.exe is a headless COM server that is unlikely to spawn conhost.exe under normal conditions.

RedSun - Named Pipe Created

Apr 28, 2026 · attack.privilege-escalation attack.stealth attack.defense-impairment attack.t1055 attack.t1685 detection.emerging-threats ·

Share on:

Detects the creation of a named pipe with the hardcoded name "REDSUN". The RedSun exploit tool uses a pipe with this name for synchronisation and command communication between its components during the Cloud Files API + oplock-based AV bypass and privilege escalation chain. RedSun creates the pipe as \??\pipe\REDSUN. The pipe server listens for the token-duplicated elevated process to connect and respond, completing the privilege escalation from user to SYSTEM. Presence of this pipe name indicates active or recent RedSun execution.

RedSun - TieringEngineService.exe Detected as EICAR Test File

Apr 28, 2026 · attack.stealth attack.defense-impairment attack.t1036.005 attack.t1685 attack.privilege-escalation attack.t1055 detection.emerging-threats ·

Share on:

Detects Windows Defender (EventID 1119 - Remediation Action Failed) flagging TieringEngineService.exe dropped in a characteristic RS-{GUID} temporary directory, or the RedSun.exe process itself being present. This covers the staging pattern used by RedSun, a Cloud Files API and opportunistic lock (oplock) based AV bypass/privilege escalation tool.

RedSun works as follows:

Registers a Cloud Files sync root and creates a Cloud Files placeholder for TieringEngineService.exe under %TEMP%\RS-{GUID}\
The placeholder file carries EICAR test file content (Virus:DOS/EICAR_Test_File) to reliably trigger a Defender scan and remediation attempt
Requests a batch oplock (FSCTL_REQUEST_BATCH_OPLOCK) on the placeholder file
When Defender attempts to scan/quarantine the file, the oplock triggers - holding the file open
During the oplock break window, RedSun swaps the mount point (junction) to redirect \?\C:\Windows\System32 to the attacker-controlled temp path
This races the AV/OS into executing the malicious TieringEngineService.exe with elevated privileges

RedSun - TieringEngineService.exe Staged in RS-Prefixed Temp Dir

Apr 28, 2026 · attack.stealth attack.t1036.005 detection.emerging-threats ·

Apr 28, 2026 · attack.persistence attack.privilege-escalation attack.defense-impairment attack.t1547.001 attack.t1112 ·

Share on:

Detects modifications to User Shell Folders registry values via reg.exe or PowerShell, which could indicate persistence attempts. Attackers may modify User Shell Folders registry values to point to malicious executables or scripts that will be executed during startup. This technique is often used to maintain persistence on a compromised system by ensuring that malicious payloads are executed automatically.

User State Changed From Guest To Member

Apr 28, 2026 · attack.persistence attack.privilege-escalation attack.initial-access attack.stealth attack.t1078.004 ·

Share on: