ADCS - Certighost Ghost Machine Account Creation

 1title: ADCS - Certighost Ghost Machine Account Creation
 2id: fa0bac5f-d170-4a91-9780-1ad71dc1f49e
 3status: experimental
 4description: |
 5    Detects the creation of a machine account whose name starts with 'GHOST', which is the
 6    naming convention used by the CVE-2026-54121 (Certighost) exploit tooling.
 7
 8    The public proof-of-concept for Certighost creates a temporary machine account with a
 9    name of the form GHOST<random>$ before enrolling for a DC certificate via the cdc chase
10    path. The attacker-controlled machine account is used as the requester identity in the
11    certificate request; the cdc attribute then redirects the CA to a rogue host that returns
12    a forged Domain Controller identity. The resulting certificate carries the DC's SID and
13    DNS name, enabling full PKINIT authentication as the targeted DC followed by DCSync.
14
15    A machine account creation event (4741) where TargetUserName starts with 'GHOST' and
16    ends with '$' is a high-fidelity indicator of this attack tool's execution. Legitimate
17    environments very rarely provision machine accounts with this prefix.    
18references:
19    - https://github.com/aniqfakhrul/CVE-2026-54121
20    - https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26
21author: Swachchhanda Shrawan Poudel (Nextron Systems)
22date: 2026-07-30
23tags:
24    - attack.privilege-escalation
25    - attack.credential-access
26    - attack.persistence
27    - attack.t1136.002
28    - attack.t1649
29    - cve.2026-54121
30    - detection.emerging-threats
31logsource:
32    product: windows
33    service: security
34    definition: |
35        Requirements:
36            Audit Policy : Account Management > Audit Computer Account Management        
37detection:
38    selection:
39        EventID: 4741
40        TargetUserName|startswith: 'GHOST'
41        TargetUserName|endswith: '$'
42    condition: selection
43falsepositives:
44    - Unlikely
45level: high