Sigma rule: ADCS - Certighost CDC Chase Certificate Request (CVE-2026-54121)

Rule

Title

ADCS - Certighost CDC Chase Certificate Request (CVE-2026-54121)

Status

experimental

Level

high

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2026-07-27

File

rules-emerging-threats/2026/Exploits/CVE-2026-54121/win_security_adcs_certighost_cdc_chase_request.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects Active Directory Certificate Services (ADCS) certificate requests that include the
'cdc' (Client DC) request attribute pointing to a domain or IP that is not a known Domain Controller.

'cdc' is an optional MS-WCCE enrollment attribute designed for cross-domain/cross-forest
scenarios where a client in a child domain tells the CA which DC to contact for identity
lookups when the CA cannot reach that domain directly. Legitimate values are DC hostnames
or IPs that resolve to a real Domain Controller computer object in AD with the
SERVER_TRUST_ACCOUNT (0x2000) userAccountControl bit set.

In an attack, the attacker sets cdc to a domain or IP they control so the CA connects to their
rogue SMB and LDAP services instead of a real DC. The rogue server returns a forged DC
identity which the pre-patch CA accepts without validation. A malicious event looks like:

Requester: DOMAIN\GHOST<random>$
Attributes: cdc:<attacker_ip>
rmd:<target_dc_fqdn>
SubjectAlternativeName: DNS Name=<target_dc_fqdn>

CVE-2026-54121 (Certighost) is the known exploit for this path. The July 2026 patch added
_ValidateChaseTargetIsDC which rejects cdc values that do not resolve to a legitimate
DC object in Active Directory before following the chase.

Log source

product

windows

service

security

definition

This requires two independent controls on the CA server. (1) CA\AuditFilter must have bit 0x04 (AUDIT_CERTSRV_REQUESTFLAGS) set this instructs certsrv.exe to emit request/issuance events. Without this bit the CA never calls ReportEvent() for certificate operations, regardless of OS policy. - Set via: certutil -setreg CA\AuditFilter 127 then net stop CertSvc; net start CertSvc. (2) The OS audit subcategory must be enabled to write those events into the Security log: auditpol /set /subcategory:"Certification Services" /success:enable. Note: GPO alone (without AuditFilter) is not sufficient.

Detection

selection:
    EventID: 4886
    Attributes|contains: 'cdc:'
filter_main_known_cdc:
    Attributes|contains|expand: '%known_cdcs%'  # should be populated with all known legitimate DC hostnames and IPs
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.privilege-escalation
• attack.credential-access
• attack.t1649
• cve.2026-54121
• detection.emerging-threats

CVEs this rule names

• CVE-2026-54121

MITRE ATT&CK ids this rule names

• T1649

Related rules

• 2a9e4f17-6c3b-4d8a-e1f0-b57c2d94a631 (similar)

References

• https://github.com/aniqfakhrul/CVE-2026-54121
• https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2026/Exploits/CVE-2026-54121/win_security_adcs_certighost_cdc_chase_request.yml