Loading

Potential CertiGhost AD CS Machine Identity Mismatch (CVE-2026-54121)

Identifies successful Active Directory Certificate Services (AD CS) certificate issuance events where a machine-account requester differs from the Remote Machine Discovery (RMD) chase target while the event's DNS subject alternative name (SAN) matches that target. This requester-to-target mismatch may indicate CertiGhost (CVE-2026-54121) or similar abuse of AD CS request-context chase processing.

Rule type: esql
Rule indices:

Rule Severity: high
Risk Score: 73
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Endpoint
  • Domain: Identity
  • OS: Windows
  • Use Case: Threat Detection
  • Tactic: Credential Access
  • Tactic: Privilege Escalation
  • Use Case: Active Directory Monitoring
  • Use Case: Vulnerability
  • Data Source: Active Directory
  • Data Source: Windows Security Event Logs
  • Resources: Investigation Guide

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

Audit Certification Services must be enabled on enterprise certification authorities so that successful certificate issuance generates Security event 4887.

The Windows Security integration must retain winlog.event_data.Attributes, including the requested SAN and chase attributes. The rule prefers dedicated certificate-template and subject-alternative-name fields when present and uses Attributes as a fallback. Dropped, truncated, or rewritten attributes create a visibility gap and do not indicate benign activity.

Setup instructions: https://ela.st/audit-certification-services

  • Does the matched AD CS issuance record validate the identity mismatch?
    • Focus: event.code, winlog.event_data.RequestId, winlog.event_data.Requester, Esql.san_value, Esql.rmd_value
    • Hint: Reopen the Windows Security 4887 record on the same CA host and request ID. Compare the parsed SAN and RMD with the complete winlog.event_data.Attributes and dedicated SAN field; additional SAN values or disagreement keep the case unresolved. $investigate_0
    • Implication: Event 4887 proves successful issuance, and the alert establishes that the requester differs from the RMD target while the parsed SAN matches that target. This is an operational anti-pattern. Close as benign only when CA records and test records identify an authorized CertiGhost or AD CS security test matching the exact CA, request ID, requester, target, template, and time.
  • What identity and authentication capability did the issued certificate receive?
    • Focus: Esql.effective_certificate_template, winlog.event_data.Subject, winlog.event_data.SubjectAlternativeName, winlog.event_data.SubjectKeyIdentifier
    • Hint: Retrieve the issued certificate and CA request/template configuration for the same request ID. Inspect the certificate's actual subject, SAN, EKUs or application policies, validity and revocation state, and the template's subject-name settings and enrollment permissions.
    • Implication: Event 4887 and the template name alone do not establish the complete certificate contents or authentication capability. A certificate that represents the RMD target and permits authentication increases the likelihood and impact of credential abuse. Missing certificate or template configuration is unresolved, not benign.
  • What other issuances by the requester appear on the same CA host?
    • Focus: host.id, winlog.event_data.Requester, winlog.event_data.RequestId, winlog.event_data.Attributes, winlog.event_data.SubjectAlternativeName
    • Hint: Recover 4887 events for the same requester on this CA host. $investigate_1
    • Implication: Repeated successful requests for different SAN/RMD targets expand the potential abuse scope. One isolated request does not reduce the significance of the current mismatch.
  • What other CA events reference the same target identity?
    • Focus: Esql.san_value, Esql.rmd_value, winlog.event_data.Attributes, winlog.event_data.SubjectAlternativeName, winlog.event_data.Requester
    • Hint: Copy the alert's exact SAN and RMD values into a scoped Timeline or Discover search for raw 4886, 4887, and 4888 records on the same CA host. Use contains or wildcard matching against winlog.event_data.Attributes and winlog.event_data.SubjectAlternativeName; derived Esql.* fields exist only on the alert.
    • Implication: Requests for the same target from additional unexpected accounts expand the affected scope. The absence of other matching events does not clear the current issuance.
  • Did the CA connect to the CDC value during certificate processing?
    • Focus: host.id, Esql.cdc_value, destination.ip, destination.port, process.name
    • Hint: When the CDC value is an IP address, search network events from the CA host around issuance for that destination.ip. For a hostname, resolve it from collected DNS or asset evidence before comparing destination IPs. Review LDAP or LDAPS from certsrv.exe and SMB from System without requiring either process for all callback traffic.
    • Implication: CA-host LDAP or SMB traffic to the CDC value supports request-context chase activity, but neither the CDC attribute nor a connection alone proves exploitation. Missing DNS or CA network telemetry is unresolved, not benign.
  • Does surrounding activity show requester creation or target-certificate use?
    • Focus: event.code, winlog.event_data.Requester, Esql.normalized_rmd_target, winlog.event_data.TargetUserName, winlog.event_data.PreAuthType
    • Hint: After validating the issuance, inspect account-management events where winlog.event_data.TargetUserName matches the requester account name without its domain prefix. Inspect successful 4768 events with winlog.event_data.PreAuthType equal to 16. For DNS-shaped RMD values, compare winlog.event_data.TargetUserName with the normalized RMD target plus $; for IP-shaped values, first resolve the associated computer account from AD, asset, or CA evidence. Treat later authentication as corroboration unless identity and certificate evidence establish the relationship.
    • Implication: Requester creation or change followed by target PKINIT strengthens the exploitation hypothesis. Missing account-management or domain-controller authentication telemetry is unresolved, not benign.

Escalate when the mismatch is not an authorized test, the issued certificate can authenticate as the target, or callback and follow-on evidence corroborate abuse. Close only when CA, certificate, and test records establish the exact authorized scope; preserve and escalate when evidence or visibility is mixed or incomplete.

The detected requester-to-target relationship is an operational anti-pattern and did not appear in the self-aligned enrollment controls. Authorized CertiGhost or AD CS security testing is the only currently validated benign explanation. Treat other claimed cross-identity enrollment workflows as unresolved until the 4887 source event, CA request record, issued certificate, template configuration, requester, target, CA, and time scope align without contradictions.

Do not close on recurrence, absence of related alerts, or the requester account name alone. ES|QL fields created by the query cannot be used in rule exceptions. If an exception is required for recurring authorized testing, combine narrowly scoped source fields such as the CA host.id, winlog.event_data.Requester, and the exact winlog.event_data.Attributes pattern. Avoid exceptions based only on a host, requester, or template.

  • Preserve the 4887 source record, CA request and database records, issued certificate and identifiers, template configuration, and relevant authentication and network evidence before disruptive action.
  • Identify affected certification authorities and apply the Microsoft security update or mitigation for CVE-2026-54121. Review request history for the requester and target to identify additional certificates requiring action.
  • If malicious activity is confirmed, revoke the affected certificate and verify that revocation information is distributed. Disable or remove an attacker-controlled requester account after preserving evidence. Rotate the target machine credentials and invalidate affected authentication material when certificate use or impersonation is established.
  • Isolate an endpoint only when host evidence attributes compromise to that system. The requester account may not map to a managed endpoint, and the target identity alone does not prove that the target endpoint was compromised.
  • Record confirmed certificate identifiers, affected principals, CA configuration gaps, and telemetry gaps for the responsible response, PKI, identity, and detection owners.
FROM logs-system.security-* METADATA _id, _index, _version
| WHERE event.code == "4887" AND
    winlog.event_data.Requester LIKE "*$" AND
    winlog.event_data.Attributes IS NOT NULL

// Parse Attributes for RMD and CDC, and as a fallback when dedicated template or SAN fields are absent.
// CDC and the effective template are retained for triage purposes
| GROK winlog.event_data.Attributes
    """(?im)^[ \t]*CertificateTemplate[ \t]*:[ \t]*(?<Esql.attributes_certificate_template>[^\r\n]+)\r?$"""
| GROK winlog.event_data.Attributes
    """(?im)^[ \t]*SAN[ \t]*:[ \t]*dns[ \t]*=[ \t]*(?<Esql.attributes_san_value>[^\r\n]+)\r?$"""
| GROK winlog.event_data.SubjectAlternativeName
    """(?im)^[ \t]*DNS[ \t]+Name[ \t]*=[ \t]*(?<Esql.event_san_value>[^\r\n]+)\r?$"""
| GROK winlog.event_data.Attributes
    """(?im)^[ \t]*cdc[ \t]*:[ \t]*(?<Esql.cdc_value>[^\r\n]+)\r?$"""
| GROK winlog.event_data.Attributes
    """(?im)^[ \t]*rmd[ \t]*:[ \t]*(?<Esql.rmd_value>[^\r\n]+)\r?$"""
| EVAL Esql.effective_certificate_template = TRIM(COALESCE(
         winlog.event_data.CertificateTemplate,
         Esql.attributes_certificate_template
       )),
       Esql.san_value = TRIM(COALESCE(Esql.event_san_value, Esql.attributes_san_value)),
       Esql.cdc_value = TRIM(Esql.cdc_value),
       Esql.rmd_value = TRIM(Esql.rmd_value),
       Esql.normalized_requester = TO_LOWER(
         REPLACE(winlog.event_data.Requester, """^.*\\|\$$""", "")
       ),
       Esql.normalized_san_value = TO_LOWER(
         REPLACE(Esql.san_value, """\.$""", "")
       ),
       Esql.normalized_rmd_value = TO_LOWER(
         REPLACE(Esql.rmd_value, """\.$""", "")
       )
// Preserve IP-shaped values; shorten other SAN and RMD values to the first DNS label for machine-account comparison.
| EVAL Esql.san_is_ip_shaped =
          Esql.normalized_san_value RLIKE """[0-9]{1,3}(\.[0-9]{1,3}){3}""" OR Esql.normalized_san_value LIKE "*:*",
       Esql.rmd_is_ip_shaped =
          Esql.normalized_rmd_value RLIKE """[0-9]{1,3}(\.[0-9]{1,3}){3}""" OR Esql.normalized_rmd_value LIKE "*:*"
| EVAL Esql.normalized_san_target = CASE(
         Esql.san_is_ip_shaped,
         Esql.normalized_san_value,
         REPLACE(Esql.normalized_san_value, """\..*$""", "")
       ),
       Esql.normalized_rmd_target = CASE(
         Esql.rmd_is_ip_shaped,
         Esql.normalized_rmd_value,
         REPLACE(Esql.normalized_rmd_value, """\..*$""", "")
       )
| WHERE Esql.normalized_requester IS NOT NULL AND
    Esql.normalized_san_target IS NOT NULL AND
    Esql.normalized_rmd_target IS NOT NULL
| WHERE Esql.normalized_requester != Esql.normalized_rmd_target AND
    Esql.normalized_san_target == Esql.normalized_rmd_target
| KEEP @timestamp, _id, _index, _version, event.code, event.action, event.category, event.type, event.outcome,
    event.created, event.ingested, data_stream.dataset, data_stream.namespace, host.id, host.name,
    winlog.computer_name, winlog.record_id, winlog.event_data.RequestId, winlog.event_data.Requester,
    winlog.event_data.CertificateTemplate, winlog.event_data.Subject, winlog.event_data.SubjectAlternativeName,
    winlog.event_data.Attributes, winlog.event_data.Disposition, winlog.event_data.SubjectKeyIdentifier,
    Esql.effective_certificate_template, Esql.san_value, Esql.cdc_value, Esql.rmd_value,
    Esql.normalized_requester, Esql.normalized_san_target, Esql.normalized_rmd_target

Framework: MITRE ATT&CK

Framework: MITRE ATT&CK