Sigma rule: ADCS - Certighost Certificate Issued via CDC Chase (CVE-2026-54121)

Rule

Title

ADCS - Certighost Certificate Issued via CDC Chase (CVE-2026-54121)

Status

experimental

Level

high

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2026-07-27

File

rules-emerging-threats/2026/Exploits/CVE-2026-54121/win_security_adcs_certighost_cert_issued_via_chase.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects successful issuance of an ADCS certificate where the request attributes include
'cdc' (Client DC) or 'rmd' (Remote Domain) pointing to a non-DC domain or IP, confirming the
CA's chase fallback path was taken against an attacker-controlled target.

'cdc' directs the CA to an address for identity lookup; 'rmd' specifies the principal to
look up there. In an attack (CVE-2026-54121, Certighost), cdc points to a rogue host that
returns a forged DC identity. A successfully issued certificate at this stage means the
attacker has obtained a cert carrying a Domain Controller's SID and DNS identity, enabling
PKINIT authentication as that DC followed by DCSync replication.

Log source

product

windows

service

security

definition

This requires two independent controls on the CA server. (1) CA\AuditFilter must have bit 0x04 (AUDIT_CERTSRV_REQUESTFLAGS) set this instructs certsrv.exe to emit request/issuance events. Without this bit the CA never calls ReportEvent() for certificate operations, regardless of OS policy. - Set via: certutil -setreg CA\AuditFilter 127 then net stop CertSvc; net start CertSvc. (2) The OS audit subcategory must be enabled to write those events into the Security log: auditpol /set /subcategory:"Certification Services" /success:enable. Note: GPO alone (without AuditFilter) is not sufficient.

Detection

selection:
    EventID: 4887
    Attributes|contains:
        - 'cdc:'
        - 'rmd:'
filter_main_known_cdc_ips:
    Attributes|contains|expand: '%known_cdcs%'  # should be populated with all known legitimate DC hostnames and IPs
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.privilege-escalation
• attack.credential-access
• attack.t1649
• cve.2026-54121
• detection.emerging-threats

CVEs this rule names

• CVE-2026-54121

MITRE ATT&CK ids this rule names

• T1649

References

• https://github.com/aniqfakhrul/CVE-2026-54121
• https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2026/Exploits/CVE-2026-54121/win_security_adcs_certighost_cert_issued_via_chase.yml