Windows Kerberos KDC: Certificate used without strong user mapping
Alerts on Windows KDC certificate validation events lacking strong certificate-to-user mapping (Event 39/41).
FreeReviewedSigma · Medium · v2
- Product
- windows
- Service
- system
- Author
- @br4dy5 (SigmaHQ), DRL 1.1
- Published
- 2023-10-09
- Updated
- 2026-07-31
What it detects
This rule flags Windows Kerberos Key Distribution Center (KDC) events where a valid certificate cannot be strongly mapped to a user, such as via explicit mapping, key trust mapping, or SID mapping. Attackers may rely on weak or missing mapping to impersonate identities or abuse certificate-based authentication paths. It uses Windows System telemetry from the KDC for Event IDs 39 and 41 and matches based on the Kerberos-Key-Distribution-Center provider names.
Reporting behind it
- support.microsoft.comhttps://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/microsoft_windows_kerberos_key_distribution_center/win_system_kdcsvc_cert_use_no_strong_mapping.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-kerberos-kdc-event-39-41-certificate-valid-without-strong-user-mapping-993c2665
title: "Windows Kerberos KDC: Certificate used without strong user mapping"
id: 98442192-e84f-454a-935a-a7686170d7b1
status: test
description: This rule flags Windows Kerberos Key Distribution Center (KDC) events where a valid certificate cannot be strongly mapped to a user, such as via explicit mapping, key trust mapping, or SID mapping. Attackers may rely on weak or missing mapping to impersonate identities or abuse certificate-based authentication paths. It uses Windows System telemetry from the KDC for Event IDs 39 and 41 and matches based on the Kerberos-Key-Distribution-Center provider names.
references:
- https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/microsoft_windows_kerberos_key_distribution_center/win_system_kdcsvc_cert_use_no_strong_mapping.yml
author: "@br4dy5, Huntrule Team"
date: 2023-10-09
modified: 2025-09-22
tags:
- attack.privilege-escalation
logsource:
product: windows
service: system
detection:
selection:
Provider_Name:
- Kerberos-Key-Distribution-Center
- Microsoft-Windows-Kerberos-Key-Distribution-Center
EventID:
- 39
- 41
condition: selection
falsepositives:
- If prevalent in the environment, filter on events where the AccountName and CN of the Subject do not reference the same user
- If prevalent in the environment, filter on CNs that end in a dollar sign indicating it is a machine name
level: medium
license: DRL-1.1
related:
- id: 993c2665-e6ef-40e3-a62a-e1a97686af79
type: derived