Windows AD CS: Detect enrollment template using CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT

title: "Windows AD CS: Detect enrollment template using CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT"
id: 627656d9-9f88-4c30-b36c-08f8c124852a
status: test
description: This rule flags Active Directory Certificate Services events where a certificate template includes the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT setting during creation or template updates. That flag can allow control over certificate subject attributes, which may enable attacker-controlled identity information and subsequent privilege or access abuse. It relies on Windows Security log telemetry for AD CS template creation (Event ID 4898) and template update (Event ID 4899), matching on the presence of the specified template flag.
references:
  - https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_adcs_certificate_template_configuration_vulnerability.yml
author: Orlinum , BlueDefenZer, Huntrule Team
date: 2021-11-17
modified: 2022-12-25
tags:
  - attack.privilege-escalation
  - attack.credential-access
logsource:
  product: windows
  service: security
  definition: Certificate services loaded a template would trigger event ID 4898 and certificate Services template was updated would trigger event ID 4899. A risk permission seems to be coming if template contain specific flag.
detection:
  selection1:
    EventID: 4898
    TemplateContent|contains: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT
  selection2:
    EventID: 4899
    NewTemplateContent|contains: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT
  condition: selection1 or selection2
falsepositives:
  - Administrator activity
  - Proxy SSL certificate with subject modification
  - Smart card enrollement
level: low
license: DRL-1.1
related:
  - id: 5ee3a654-372f-11ec-8d3d-0242ac130003
    type: derived