Hayabusa high experimental sigma

ADCS - Certighost Certificate Issued via CDC Chase (CVE-2026-54121)

Detects successful issuance of an ADCS certificate where the request attributes include 'cdc' (Client DC) or 'rmd' (Remote Domain) pointing to a non-DC domain or IP, confirming the CA's chase fallback path was taken against an attacker-controlled target. 'cdc' directs the CA to an address for identity lookup; 'rmd' specifies the principal to look up there. In an attack (CVE-2026-54121, Certighost), cdc points to a rogue host that returns a forged DC identity. A successfully issued certificate at this stage means the attacker has obtained a cert carrying a Domain Controller's SID and DNS identity, enabling PKINIT authentication as that DC followed by DCSync replication.

View Source

Detection Logic

{
  "security": {
    "Channel": "Security"
  },
  "selection": {
    "EventID": 4887,
    "Attributes
| contains": [
      "cdc:",
      "rmd:"
    ]
  },
  "filter_main_known_cdc_ips": {
    "Attributes
| contains
| expand": "%known_cdcs%"
  },
  "condition": "security and (selection and not 1 of filter_main_*)"
}

False Positives

⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...