Windows Execution of Certify.exe for AD Certificate Abuse Attempts

title: Windows Execution of Certify.exe for AD Certificate Abuse Attempts
id: 7a7a6284-027b-444c-aa56-b06972ce482c
status: test
description: This rule flags process executions where the image metadata matches Certify.exe and the command line includes common Certify subcommands and option patterns used for Active Directory certificate abuse. Attackers leverage Certify to automate discovery and certificate request workflows, often targeting vulnerable configurations and specifying templates, alternate names, and CA/domain parameters. The detection relies on Windows process creation telemetry, matching PE image characteristics and targeted substrings in the command line.
references:
  - https://github.com/GhostPack/Certify
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_certify.yml
author: pH-T (Nextron Systems), Huntrule Team
date: 2023-04-17
modified: 2023-04-25
tags:
  - attack.discovery
  - attack.credential-access
  - attack.t1649
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \Certify.exe
    - OriginalFileName: Certify.exe
    - Description|contains: Certify
  selection_cli_commands:
    CommandLine|contains:
      - ".exe cas "
      - ".exe find "
      - ".exe pkiobjects "
      - ".exe request "
      - ".exe download "
  selection_cli_options:
    CommandLine|contains:
      - " /vulnerable"
      - " /template:"
      - " /altname:"
      - " /domain:"
      - " /path:"
      - " /ca:"
  condition: selection_img or all of selection_cli_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 762f2482-ff21-4970-8939-0aa317a886bb
    type: derived