Hayabusa high test sigma

ADCS Certificate Template Configuration Vulnerability with Risky EKU

Detects certificate creation with template allowing risk permission subject and risky EKU

View Source

Detection Logic

{
  "security": {
    "Channel": "Security"
  },
  "selection10": {
    "EventID": 4898,
    "TemplateContent
| contains": [
      "1.3.6.1.5.5.7.3.2",
      "1.3.6.1.5.2.3.4",
      "1.3.6.1.4.1.311.20.2.2",
      "2.5.29.37.0"
    ]
  },
  "selection11": {
    "TemplateContent
| contains": "CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT"
  },
  "selection20": {
    "EventID": 4899,
    "NewTemplateContent
| contains": [
      "1.3.6.1.5.5.7.3.2",
      "1.3.6.1.5.2.3.4",
      "1.3.6.1.4.1.311.20.2.2",
      "2.5.29.37.0"
    ]
  },
  "selection21": {
    "NewTemplateContent
| contains": "CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT"
  },
  "condition": "security and ((selection10 and selection11) or (selection20 and selection21))"
}

False Positives

  • ⚠ Administrator activity
  • ⚠ Proxy SSL certificate with subject modification
  • ⚠ Smart card enrollement

Field Validations

Loading…

Comments (0)

Loading comments...