Certighost AD CS Vulnerability: Detection and Remediation for Windows Domain Hijacking

---
title: Certighost - Suspicious Certificate Enrollment via Certutil
id: 8a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects the use of certutil.exe to request certificates, specifically targeting the CA configuration which is indicative of enrollment activity often seen in AD CS attacks like Certighost.
references:
  - https://attack.mitre.org/techniques/T1649/
author: Security Arsenal
date: 2026/04/18
tags:
  - attack.credential_access
  - attack.t1649
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\certutil.exe'
    CommandLine|contains:
      - '-config'
      - '-submit'
      - '-request'
  condition: selection
falsepositives:
  - Legitimate administrator manual enrollment or scripting
level: medium
---
title: Certighost - Suspicious Certreq Execution for Enrollment
id: 9b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects the use of certreq.exe to submit certificate requests to a CA. This tool is frequently used in PoCs for AD CS vulnerabilities.
references:
  - https://attack.mitre.org/techniques/T1649/
author: Security Arsenal
date: 2026/04/18
tags:
  - attack.credential_access
  - attack.t1649
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\certreq.exe'
    CommandLine|contains:
      - '-submit'
      - '-attrib'
  condition: selection
falsepositives:
  - Automated certificate enrollment services (Auto-Enrollment)
level: medium
---
title: Certighost - PowerShell Certificate Request Activity
id: 0c3d4e5f-6a7b-8c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects PowerShell scripts invoking certificate request classes or cmdlets, which may indicate a script-based exploitation of AD CS.
references:
  - https://attack.mitre.org/techniques/T1059/001
author: Security Arsenal
date: 2026/04/18
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'System.Security.Cryptography.X509Certificates'
      - 'CertEnroll'
      - 'CertificateAuthority'
  condition: selection
falsepositives:
  - System administration scripts utilizing PKI modules
level: low

// Hunt for suspicious enrollment tools and correlate with CA request failures/success
let EnrollmentTools = dynamic(["certutil.exe", "certreq.exe"]);
DeviceProcessEvents
| where FileName in (EnrollmentTools)
| where ProcessCommandLine has_any ("-submit", "-config", "-attrib")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| join kind=leftouter (
    SecurityEvent 
    | where EventID in (4886, 4887) // Certificate Services: Request and Issuance
    | project RequestTime = TimeGenerated, Subject, RequesterName, Status
) on $left.DeviceName == $right.Computer
| where isnotnull(Status)

-- Hunt for certificate enrollment utility execution
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'certutil.exe'
   OR Name =~ 'certreq.exe'

# Audit AD CS Templates for ESC1-like vulnerabilities (SAN enablement)
# Requires Active Directory module and RSAT tools

Write-Host "[+] Auditing AD CS Certificate Templates for potential misconfigurations..." -ForegroundColor Cyan

try {
    # Get all certificate templates
    $templates = Get-ADObject -LDAPFilter "(objectClass=pKICertificateTemplate)" -Properties *
    
    $vulnerableTemplates = @()

    foreach ($template in $templates) {
        $msPKI-Certificate-Name-Flag = $template.'msPKI-Certificate-Name-Flag'
        $msPKI-Enrollment-Flag = $template.'msPKI-Enrollment-Flag'
        $msPKI-RA-Signature = $template.'msPKI-RA-Signature'
        
        # Check if ENROLLEE_SUPPLIES_SUBJECT is set (Flag 0x00000001)
        # If 0x1 is present in msPKI-Certificate-Name-Flag
        if ($msPKI-Certificate-Name-Flag -band 1) {
            # Check for Client Authentication EKU (OID 1.3.6.1.5.5.7.3.2)
            $ekus = $template.'msPKI-Extended-Key-Usage'
            if ($ekus -contains "1.3.6.1.5.5.7.3.2") {
                # Check if "Domain Users" or "Authenticated Users" have enrollment rights
                $acl = (Get-Acl "AD:$($template.DistinguishedName)").Access
                $principalHasRights = $false
                
                foreach ($ace in $acl) {
                    if ($ace.IdentityReference -like "*Domain Users*" -or $ace.IdentityReference -like "*Authenticated Users*") {
                        if ($ace.ActiveDirectoryRights -match "GenericRead|ExtendedRight") {
                            $principalHasRights = $true
                        }
                    }
                }

                if ($principalHasRights) {
                    $vulnerableTemplates += $template
                }
            }
        }
    }

    if ($vulnerableTemplates.Count -gt 0) {
        Write-Host "[!] CRITICAL: Found templates vulnerable to potential SAN injection (ESC1/Certighost style):" -ForegroundColor Red
        $vulnerableTemplates | Select-Object Name, DisplayName, DistinguishedName | Format-Table -AutoSize
    } else {
        Write-Host "[+] No high-risk templates found with ENROLLEE_SUPPLIES_SUBJECT and low-privileged enrollment." -ForegroundColor Green
    }
} catch {
    Write-Error "[-] Error during audit: Ensure you are running as Domain Admin and have RSAT installed."
    Write-Error $_.Exception.Message
}