Windows Process Creation: Certipy.exe Tool Execution Based on PE and Command-Line Indicators

title: "Windows Process Creation: Certipy.exe Tool Execution Based on PE and Command-Line Indicators"
id: f948efc9-38c3-4516-92ae-c3acf8dae498
status: test
description: This rule identifies execution of Certipy.exe on Windows by matching PE/image metadata (file name and description content) and common Certipy command-line arguments and flags used for Active Directory Certificate Services discovery and certificate abuse workflows. Attackers leverage Certipy to enumerate certificate authority and templates and to request or manipulate certificates to enable credential access and follow-on activity. The detection relies on Windows process creation telemetry including Image path, OriginalFileName, Description, and CommandLine content.
references:
  - https://github.com/ly4k/Certipy
  - https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-gui-new-authentication-and-request-methods-and-more-7237d88061f7
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_certipy.yml
author: pH-T (Nextron Systems), Sittikorn Sangrattanapitak, Huntrule Team
date: 2023-04-17
modified: 2024-10-08
tags:
  - attack.discovery
  - attack.credential-access
  - attack.t1649
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \Certipy.exe
    - OriginalFileName: Certipy.exe
    - Description|contains: Certipy
  selection_cli_commands:
    CommandLine|contains:
      - " account "
      - " auth "
      - " cert "
      - " find "
      - " forge "
      - " ptt "
      - " relay "
      - " req "
      - " shadow "
      - " template "
  selection_cli_flags:
    CommandLine|contains:
      - " -bloodhound"
      - " -ca-pfx "
      - " -dc-ip "
      - " -kirbi"
      - " -old-bloodhound"
      - " -pfx "
      - " -target"
      - " -template"
      - " -username "
      - " -vulnerable"
      - auth -pfx
      - shadow auto
      - shadow list
  condition: selection_img or all of selection_cli_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 6938366d-8954-4ddc-baff-c830b3ba8fcd
    type: derived