ADCS - Certighost Certificate Issued via CDC Chase (CVE-2026-54121)

 1title: ADCS - Certighost Certificate Issued via CDC Chase (CVE-2026-54121)
 2id: 8b7e2c54-1f93-4a6d-b8e0-3c9d7f25a168
 3status: experimental
 4description: |
 5    Detects successful issuance of an ADCS certificate where the request attributes include
 6    'cdc' (Client DC) or 'rmd' (Remote Domain) pointing to a non-DC domain or IP, confirming the
 7    CA's chase fallback path was taken against an attacker-controlled target.
 8
 9    'cdc' directs the CA to an address for identity lookup; 'rmd' specifies the principal to
10    look up there. In an attack (CVE-2026-54121, Certighost), cdc points to a rogue host that
11    returns a forged DC identity. A successfully issued certificate at this stage means the
12    attacker has obtained a cert carrying a Domain Controller's SID and DNS identity, enabling
13    PKINIT authentication as that DC followed by DCSync replication.    
14references:
15    - https://github.com/aniqfakhrul/CVE-2026-54121
16    - https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26
17author: Swachchhanda Shrawan Poudel (Nextron Systems)
18date: 2026-07-27
19tags:
20    - attack.privilege-escalation
21    - attack.credential-access
22    - attack.t1649
23    - cve.2026-54121
24    - detection.emerging-threats
25logsource:
26    product: windows
27    service: security
28    definition: |
29        This requires two independent controls on the CA server.
30            (1) CA\AuditFilter must have bit 0x04 (AUDIT_CERTSRV_REQUESTFLAGS) set
31                this instructs certsrv.exe to emit request/issuance events.
32                Without this bit the CA never calls ReportEvent() for certificate operations, regardless of OS policy.
33                    - Set via: certutil -setreg CA\AuditFilter 127 then net stop CertSvc; net start CertSvc.
34            (2) The OS audit subcategory must be enabled to write those events into the Security log:
35                auditpol /set /subcategory:"Certification Services" /success:enable.
36        Note: GPO alone (without AuditFilter) is not sufficient.        
37detection:
38    selection:
39        EventID: 4887
40        Attributes|contains:
41            - 'cdc:'
42            - 'rmd:'
43    filter_main_known_cdc_ips:
44        Attributes|contains|expand: '%known_cdcs%'  # should be populated with all known legitimate DC hostnames and IPs
45    condition: selection and not 1 of filter_main_*
46falsepositives:
47    - Unknown
48level: high