Sigma rule: Certificate Use With No Strong Mapping

Rule

Title

Certificate Use With No Strong Mapping

Status

test

Level

medium

Author

@br4dy5

Date

2023-10-09

Modified

2025-09-22

File

rules/windows/builtin/system/microsoft_windows_kerberos_key_distribution_center/win_system_kdcsvc_cert_use_no_strong_mapping.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID)
This could be a sign of exploitation of the elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping.
Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing.

Log source

product

windows

service

system

Detection

selection:
    Provider_Name:
        - 'Kerberos-Key-Distribution-Center'
        - 'Microsoft-Windows-Kerberos-Key-Distribution-Center'
    EventID:
        - 39
        - 41 # For Windows Server 2008 R2 SP1 and Windows Server 2008 SP2
condition: selection

False positives (as the rule lists them)

• If prevalent in the environment, filter on events where the AccountName and CN of the Subject do not reference the same user
• If prevalent in the environment, filter on CNs that end in a dollar sign indicating it is a machine name

Tags

• attack.privilege-escalation

References

• https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/system/microsoft_windows_kerberos_key_distribution_center/win_system_kdcsvc_cert_use_no_strong_mapping.yml