Windows Process Creation: ADCSPwn Command-Line Parameters Indicating ADCS Abuse
Identifies Windows processes with command-line arguments consistent with ADCSPwn targeting ADCS and a specified port.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-07-31
- Updated
- 2026-07-31
ATT&CK techniques
Cred Access → CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Discovery
Lateral Movement
C2
Exfiltration
Impact
What it detects
This rule flags Windows process executions whose command line includes specific parameter patterns associated with ADCSPwn. The behavior matters because ADCSPwn is used to interact with AD CS endpoints and can be leveraged as part of privilege escalation in active directory environments. Telemetry relies on process creation events with access to full command-line arguments.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: ADCSPwn Command-Line Parameters Indicating ADCS Abuse"
id: 5c0296fa-8b14-450e-b961-70affb0cf0f7
status: test
description: This rule flags Windows process executions whose command line includes specific parameter patterns associated with ADCSPwn. The behavior matters because ADCSPwn is used to interact with AD CS endpoints and can be leveraged as part of privilege escalation in active directory environments. Telemetry relies on process creation events with access to full command-line arguments.
references:
- https://github.com/bats3c/ADCSPwn
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_adcspwn.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-07-31
modified: 2023-02-04
tags:
- attack.collection
- attack.credential-access
- attack.t1557.001
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains|all:
- " --adcs "
- " --port "
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: cd8c163e-a19b-402e-bdd5-419ff5859f12
type: derived