Windows Process Command Line Indicative of ADCSPwn Use via ADCS Options

title: Windows Process Command Line Indicative of ADCSPwn Use via ADCS Options
id: 5c0296fa-8b14-450e-b961-70affb0cf0f7
status: test
description: This rule flags Windows process creation events whose command line contains ADCSPwn-specific arguments related to Active Directory Certificate Services, including the presence of "--adcs" and "--port". Attackers may use this tool to interact with certificate services in an attempt to coerce authentication and perform certificate-based abuse within an Active Directory environment. Detection relies on process creation telemetry and substring matching on the full command line.
references:
  - https://github.com/bats3c/ADCSPwn
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_adcspwn.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-07-31
modified: 2023-02-04
tags:
  - attack.collection
  - attack.credential-access
  - attack.t1557.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - " --adcs "
      - " --port "
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: cd8c163e-a19b-402e-bdd5-419ff5859f12
    type: derived