huntrule

Windows ADCS Certificate Template Changes with Risky EKU and Enrollee-Provided Subject

Flags ADCS template load/update events (4898/4899) when risky EKU OIDs and enrollee-supplied subject are present.

FreeUnreviewedSigmahighv1
title: Windows ADCS Certificate Template Changes with Risky EKU and Enrollee-Provided Subject
id: 2541e5e5-8ee2-46b0-bd07-07afddda2115
status: test
description: This rule identifies ADCS certificate template creation or updates where the template content includes specific risky EKU OIDs along with a flag indicating the enrollee can supply the certificate subject. An attacker could abuse these template settings to obtain certificates that enable privilege escalation or credential access by influencing certificate identity and usage. It relies on Windows Security events 4898 (template loaded/created) and 4899 (template updated) and inspects TemplateContent/NewTemplateContent for the configured OIDs and the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT marker.
references:
  - https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_adcs_certificate_template_configuration_vulnerability_eku.yml
author: Orlinum , BlueDefenZer, Huntrule Team
date: 2021-11-17
modified: 2022-12-25
tags:
  - attack.privilege-escalation
  - attack.credential-access
logsource:
  product: windows
  service: security
  definition: Certificate services loaded a template would trigger event ID 4898 and certificate Services template was updated would trigger event ID 4899. A risk permission seems to be coming if template contain specific flag with risky EKU.
detection:
  selection10:
    EventID: 4898
    TemplateContent|contains:
      - 1.3.6.1.5.5.7.3.2
      - 1.3.6.1.5.2.3.4
      - 1.3.6.1.4.1.311.20.2.2
      - 2.5.29.37.0
  selection11:
    TemplateContent|contains: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT
  selection20:
    EventID: 4899
    NewTemplateContent|contains:
      - 1.3.6.1.5.5.7.3.2
      - 1.3.6.1.5.2.3.4
      - 1.3.6.1.4.1.311.20.2.2
      - 2.5.29.37.0
  selection21:
    NewTemplateContent|contains: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT
  condition: (selection10 and selection11) or (selection20 and selection21)
falsepositives:
  - Administrator activity
  - Proxy SSL certificate with subject modification
  - Smart card enrollement
level: high
license: DRL-1.1
related:
  - id: bfbd3291-de87-4b7c-88a2-d6a5deb28668
    type: derived

What it detects

This rule identifies ADCS certificate template creation or updates where the template content includes specific risky EKU OIDs along with a flag indicating the enrollee can supply the certificate subject. An attacker could abuse these template settings to obtain certificates that enable privilege escalation or credential access by influencing certificate identity and usage. It relies on Windows Security events 4898 (template loaded/created) and 4899 (template updated) and inspects TemplateContent/NewTemplateContent for the configured OIDs and the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT marker.

Known false positives

  • Administrator activity
  • Proxy SSL certificate with subject modification
  • Smart card enrollement

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.