Certighost: Active Directory DC Impersonation and DCSync — Detection and Hardening

---
title: Potential Certighost ADCS DC Impersonation
id: 8a4b3c1d-5e6f-4a2b-9c8d-1e2f3a4b5c6d
status: experimental
description: Detects potential Certighost activity where a certificate request contains a Subject Name resembling a Domain Controller, initiated by a low-privileged user.
references:
  - https://thehackernews.com/2026/07/certighost-exploit-lets-low-privileged.html
author: Security Arsenal
date: 2026/07/25
tags:
  - attack.credential_access
  - attack.t1649
logsource:
  product: windows
  service: security
detection:
  selection:
    Message|contains:
      - 'Certificate Services'
      - 'Request'
    Subject|contains:
      - 'DC$'
      - 'Domain Controller'
  filter:
    SubjectUserName|contains:
      - 'Administrator'
      - 'SYSTEM'
      - 'Enterprise Admins'
      - 'Domain Admins'
  condition: selection and not filter
falsepositives:
  - Legitimate administrative certificate management for DCs (rare for low-priv users)
level: high
---
title: DCSync Activity via Directory Replication Services
id: 9c5d4e2f-6f7a-4b3c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects DCSync replication requests indicative of krbtgt hash dumping, often the follow-on to Certighost exploitation.
references:
  - https://attack.mitre.org/techniques/T1003/006/
author: Security Arsenal
date: 2026/07/25
tags:
  - attack.credential_access
  - attack.t1003.006
logsource:
  product: windows
  service: security
detection:
  selection:
    Operation|contains: 'Directory Replication'
    AccessMask|contains: '0x100'
    SubjectUserName|contains:
      - '$'
  filter:
    SubjectUserName|contains:
      - 'DOMAIN DC$'
  condition: selection and not filter
falsepositives:
  - Legitimate backup software or DC-to-DC replication (Ensure source is a known DC)
level: critical

SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID in (4887, 4888) // Certificate Request and Issuance
| extend RequesterName = ColumnIfExists("RequesterName", ""),
         CertificateTemplateName = ColumnIfExists("CertificateTemplateName", ""),
         Subject = ColumnIfExists("Subject", "")
| where Subject contains "DC$" or Subject contains "Domain Controller"
| where not(RequesterName has @"Domain Admins" or RequesterName has @"Enterprise Admins" or RequesterName == "SYSTEM")
| project TimeGenerated, Computer, Account, AccountType, Subject, CertificateTemplateName, RequesterName, Message
| order by TimeGenerated desc

-- Hunt for ADCS exploitation tools and suspicious certificate logs
SELECT 
  Pid, 
  Name, 
  CommandLine, 
  Exe, 
  Username 
FROM pslist()
WHERE Name =~ 'certipy' 
   OR Name =~ 'certify'
   OR CommandLine =~ 'template'
   OR CommandLine =~ 'DC$'
   OR CommandLine =~ 'get证书' 
   OR CommandLine =~ 'request'

-- Additionally, search for recent certificate logs (optional artifact collection)
-- SELECT * FROM glob(globs='C:\\Windows\\System32\\winevt\\Logs\\Microsoft-Windows-CertificateServicesClient-Lifecycle-System%4Operational.evtx')

<#
.SYNOPSIS
    Audit Active Directory Certificate Templates for Certighost risk indicators.
.DESCRIPTION
    Identifies templates with 'MS-PKI-Certificate-Name-Flag' set to allow subject
    name request or templates with 'Client Authentication' EKU that might be
    abused for impersonation.
#>

Import-Module ActiveDirectory

Write-Host "[+] Starting ADCS Template Audit for Certighost susceptibility..." -ForegroundColor Cyan

try {
    $Templates = Get-ADObject -LDAPFilter "(objectClass=pkicertificatetemplate)" -Properties *
    $RiskCount = 0

    foreach ($Template in $Templates) {
        $TemplateName = $Template.Name
        $Flags = $Template.'msPKI-Certificate-Name-Flag'
        $EKU = $Template.'msPKI-Template-Schema-Version'
        $EnrollRights = $Template | Get-ACL | Select-Object -ExpandProperty Access | 
                        Where-Object { $_.IdentityReference -notmatch "BUILTIN|NT AUTHORITY" -and $_.AccessControlType -eq "Allow" }

        # Check for Enroll flag or subject name flag (CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT = 0x00000001)
        # and check if low-privileged users have enroll rights.
        $EnrolleeSuppliesSubject = ($Flags -band 1) -eq 1
        
        # Determine if template has 'Client Authentication' EKU (OID: 1.3.6.1.5.5.7.3.2)
        $HasClientAuthEKU = $Template.'msPKI-Certificate-Application-Policy' -match "1.3.6.1.5.5.7.3.2"

        if ($EnrolleeSuppliesSubject -and $HasClientAuthEKU) {
            Write-Host "[!] RISK FOUND: $TemplateName" -ForegroundColor Red
            Write-Host "    - Allows Enrollee Supplies Subject"
            Write-Host "    - Has Client Authentication EKU"
            Write-Host "    - Check Enrollment Rights (Run 'Get-ACL' manually for details)"
            $RiskCount++
        }
    }

    if ($RiskCount -eq 0) {
        Write-Host "[+] No high-risk templates found matching Certighost criteria." -ForegroundColor Green
    } else {
        Write-Host "[!] Audit complete. $RiskCount high-risk templates identified." -ForegroundColor Yellow
    }
}
catch {
    Write-Error "[-] Error running audit: $_"
}