ADCS - Certighost CDC Chase Certificate Request (CVE-2026-54121)

 1title: ADCS - Certighost CDC Chase Certificate Request (CVE-2026-54121)
 2id: c4a1f389-2e6b-4d9a-8f0c-b73e5a12d947
 3related:
 4    - id: 2a9e4f17-6c3b-4d8a-e1f0-b57c2d94a631
 5      type: similar
 6status: experimental
 7description: |
 8    Detects Active Directory Certificate Services (ADCS) certificate requests that include the
 9    'cdc' (Client DC) request attribute pointing to a domain or IP that is not a known Domain Controller.
10
11    'cdc' is an optional MS-WCCE enrollment attribute designed for cross-domain/cross-forest
12    scenarios where a client in a child domain tells the CA which DC to contact for identity
13    lookups when the CA cannot reach that domain directly. Legitimate values are DC hostnames
14    or IPs that resolve to a real Domain Controller computer object in AD with the
15    SERVER_TRUST_ACCOUNT (0x2000) userAccountControl bit set.
16
17    In an attack, the attacker sets cdc to a domain or IP they control so the CA connects to their
18    rogue SMB and LDAP services instead of a real DC. The rogue server returns a forged DC
19    identity which the pre-patch CA accepts without validation. A malicious event looks like:
20
21        Requester: DOMAIN\GHOST<random>$
22        Attributes: cdc:<attacker_ip>
23                    rmd:<target_dc_fqdn>
24        SubjectAlternativeName: DNS Name=<target_dc_fqdn>
25
26    CVE-2026-54121 (Certighost) is the known exploit for this path. The July 2026 patch added
27    _ValidateChaseTargetIsDC which rejects cdc values that do not resolve to a legitimate
28    DC object in Active Directory before following the chase.    
29references:
30    - https://github.com/aniqfakhrul/CVE-2026-54121
31    - https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26
32author: Swachchhanda Shrawan Poudel (Nextron Systems)
33date: 2026-07-27
34tags:
35    - attack.privilege-escalation
36    - attack.credential-access
37    - attack.t1649
38    - cve.2026-54121
39    - detection.emerging-threats
40logsource:
41    product: windows
42    service: security
43    definition: |
44        This requires two independent controls on the CA server.
45            (1) CA\AuditFilter must have bit 0x04 (AUDIT_CERTSRV_REQUESTFLAGS) set
46                this instructs certsrv.exe to emit request/issuance events.
47                Without this bit the CA never calls ReportEvent() for certificate operations, regardless of OS policy.
48                    - Set via: certutil -setreg CA\AuditFilter 127 then net stop CertSvc; net start CertSvc.
49            (2) The OS audit subcategory must be enabled to write those events into the Security log:
50                auditpol /set /subcategory:"Certification Services" /success:enable.
51        Note: GPO alone (without AuditFilter) is not sufficient.        
52detection:
53    selection:
54        EventID: 4886
55        Attributes|contains: 'cdc:'
56    filter_main_known_cdc:
57        Attributes|contains|expand: '%known_cdcs%'  # should be populated with all known legitimate DC hostnames and IPs
58    condition: selection and not 1 of filter_main_*
59falsepositives:
60    - Unknown
61level: high