Certificate Use With No Strong Mapping

 1title: Certificate Use With No Strong Mapping
 2id: 993c2665-e6ef-40e3-a62a-e1a97686af79
 3status: experimental
 4description: |
 5    Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID)
 6    This could be a sign of exploitation of the elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping.
 7    Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing.    
 8references:
 9    - https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16
10author: '@br4dy5'
11date: 2023/10/09
12tags:
13    - attack.privilege_escalation
14logsource:
15    product: windows
16    service: system
17detection:
18    selection:
19        Provider_Name: 'Kerberos-Key-Distribution-Center'
20        EventID:
21            - 39
22            - 41 # For Windows Server 2008 R2 SP1 and Windows Server 2008 SP2
23    condition: selection
24falsepositives:
25    - If prevalent in the environment, filter on events where the AccountName and CN of the Subject do not reference the same user
26    - If prevalent in the environment, filter on CNs that end in a dollar sign indicating it is a machine name
27level: medium