ADCS - Certighost CDC Chase Certificate Request (CVE-2026-54121)

Detects Active Directory Certificate Services (ADCS) certificate requests that include the 'cdc' (Client DC) request attribute pointing to a domain or IP that is not a known Domain Controller. 'cdc' is an optional MS-WCCE enrollment attribute designed for cross-domain/cross-forest scenarios where a client in a child domain tells the CA which DC to contact for identity lookups when the CA cannot reach that domain directly. Legitimate values are DC hostnames or IPs that resolve to a real Domain Controller computer object in AD with the SERVER_TRUST_ACCOUNT (0x2000) userAccountControl bit set. In an attack, the attacker sets cdc to a domain or IP they control so the CA connects to their rogue SMB and LDAP services instead of a real DC. The rogue server returns a forged DC identity which the pre-patch CA accepts without validation. A malicious event looks like: Requester: DOMAIN\GHOST<random>$ Attributes: cdc:<attacker_ip> rmd:<target_dc_fqdn> SubjectAlternativeName: DNS Name=<target_dc_fqdn> CVE-2026-54121 (Certighost) is the known exploit for this path. The July 2026 patch added _ValidateChaseTargetIsDC which rejects cdc values that do not resolve to a legitimate DC object in Active Directory before following the chase.