Suspicious Certificate Use With No Strong Mapping (via system)

title: Suspicious Certificate Use With No Strong Mapping (via system)
id: b318ec61-5e33-599a-a5c5-f532ece15d12
status: stable
description: This rule detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID) This could be a sign of exploitation of the elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC enables certificate spoofing by not requiring a strong mapping. Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign suggesting a machine, may indicate certificate spoofing.
references:
    - https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16
author: 'Huntrule Team'
date: 2026-03-01
tags:
    - attack.privilege-escalation
    - attack.credential-access
    - attack.t1068
    - attack.t1649
logsource:
    product: windows
    service: system
detection:
    selection:
        Provider_Name:
            - 'Kerberos-Key-Distribution-Center'
            - 'Microsoft-Windows-Kerberos-Key-Distribution-Center'
        EventID:
            - 39
            - 41
    condition: selection
falsepositives:
    - Unknown
level: medium