Windows Kerberos KDC Event 39/41: Certificate Valid Without Strong User Mapping

Alerts on Windows KDC certificate validation events lacking strong certificate-to-user mapping (Event 39/41).

FreeUnreviewedSigmamediumv1

windows-kerberos-kdc-event-39-41-certificate-valid-without-strong-user-mapping-993c2665

title: "Windows Kerberos KDC Event 39/41: Certificate Valid Without Strong User Mapping"
id: 98442192-e84f-454a-935a-a7686170d7b1
status: test
description: This rule flags Kerberos Key Distribution Center events where a user certificate is considered valid but cannot be strongly mapped to a specific account. Attackers may exploit weaknesses in certificate-based authentication to impersonate users or enable privilege escalation when the KDC does not enforce strong mapping requirements. The detection relies on Windows System logs for KDC Provider_Name values and EventID 39 or 41, indicating certificate-to-user mapping failures.
references:
  - https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/microsoft_windows_kerberos_key_distribution_center/win_system_kdcsvc_cert_use_no_strong_mapping.yml
author: "@br4dy5, Huntrule Team"
date: 2023-10-09
modified: 2025-09-22
tags:
  - attack.privilege-escalation
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name:
      - Kerberos-Key-Distribution-Center
      - Microsoft-Windows-Kerberos-Key-Distribution-Center
    EventID:
      - 39
      - 41
  condition: selection
falsepositives:
  - If prevalent in the environment, filter on events where the AccountName and CN of the Subject do not reference the same user
  - If prevalent in the environment, filter on CNs that end in a dollar sign indicating it is a machine name
level: medium
license: DRL-1.1
related:
  - id: 993c2665-e6ef-40e3-a62a-e1a97686af79
    type: derived

What it detects

This rule flags Kerberos Key Distribution Center events where a user certificate is considered valid but cannot be strongly mapped to a specific account. Attackers may exploit weaknesses in certificate-based authentication to impersonate users or enable privilege escalation when the KDC does not enforce strong mapping requirements. The detection relies on Windows System logs for KDC Provider_Name values and EventID 39 or 41, indicating certificate-to-user mapping failures.

Known false positives

If prevalent in the environment, filter on events where the AccountName and CN of the Subject do not reference the same user
If prevalent in the environment, filter on CNs that end in a dollar sign indicating it is a machine name

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.