Windows Process Creation: Certipy Tool Execution Based on PE and CLI Parameters
Flags Certipy.exe execution on Windows using PE metadata and Certipy-like AD CS command-line arguments.
- Product
- windows
- Category
- process_creation
- Author
- pH-T (Nextron Systems), Sittikorn Sangrattanapitak (SigmaHQ), DRL 1.1
- Published
- 2023-04-17
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies executions of Certipy by matching process image characteristics associated with Certipy.exe and by requiring common Certipy command-line keywords and flags related to AD CS enumeration and certificate abuse. Attackers use Certipy to query Active Directory Certificate Services and perform actions such as relaying, requesting, forging, and shadow-related operations. The detection relies on Windows process creation telemetry, including image filename/metadata and full command-line content.
Reporting behind it
- github.comhttps://github.com/ly4k/Certipy
- research.ifcr.dkhttps://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-gui-new-authentication-and-request-methods-and-more-7237d88061f7
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_certipy.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Certipy Tool Execution Based on PE and CLI Parameters"
id: f948efc9-38c3-4516-92ae-c3acf8dae498
status: test
description: This rule identifies executions of Certipy by matching process image characteristics associated with Certipy.exe and by requiring common Certipy command-line keywords and flags related to AD CS enumeration and certificate abuse. Attackers use Certipy to query Active Directory Certificate Services and perform actions such as relaying, requesting, forging, and shadow-related operations. The detection relies on Windows process creation telemetry, including image filename/metadata and full command-line content.
references:
- https://github.com/ly4k/Certipy
- https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-gui-new-authentication-and-request-methods-and-more-7237d88061f7
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_certipy.yml
author: pH-T (Nextron Systems), Sittikorn Sangrattanapitak, Huntrule Team
date: 2023-04-17
modified: 2024-10-08
tags:
- attack.discovery
- attack.credential-access
- attack.t1649
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \Certipy.exe
- OriginalFileName: Certipy.exe
- Description|contains: Certipy
selection_cli_commands:
CommandLine|contains:
- " account "
- " auth "
- " cert "
- " find "
- " forge "
- " ptt "
- " relay "
- " req "
- " shadow "
- " template "
selection_cli_flags:
CommandLine|contains:
- " -bloodhound"
- " -ca-pfx "
- " -dc-ip "
- " -kirbi"
- " -old-bloodhound"
- " -pfx "
- " -target"
- " -template"
- " -username "
- " -vulnerable"
- auth -pfx
- shadow auto
- shadow list
condition: selection_img or all of selection_cli_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 6938366d-8954-4ddc-baff-c830b3ba8fcd
type: derived