Detection rules › Sigma

HackTool - Certipy Execution

Severity
high
Author
pH-T (Nextron Systems), Sittikorn Sangrattanapitak
Source
upstream

Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments.

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1649 Steal or Forge Authentication Certificates

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: selection_img

or:
Description|contains: Certipy
Image|endswith: '\Certipy.exe'
OriginalFileName: Certipy.exe

Stage 2: all of selection_cli_commands

or:
CommandLine|contains: ' account '
CommandLine|contains: ' auth '
CommandLine|contains: ' cert '
CommandLine|contains: ' find '
CommandLine|contains: ' forge '
CommandLine|contains: ' ptt '
CommandLine|contains: ' relay '
CommandLine|contains: ' req '
CommandLine|contains: ' shadow '
CommandLine|contains: ' template '

Stage 3: all of selection_cli_flags

or:
CommandLine|contains: ' -bloodhound'
CommandLine|contains: ' -ca-pfx '
CommandLine|contains: ' -dc-ip '
CommandLine|contains: ' -kirbi'
CommandLine|contains: ' -old-bloodhound'
CommandLine|contains: ' -pfx '
CommandLine|contains: ' -target'
CommandLine|contains: ' -template'
CommandLine|contains: ' -username '
CommandLine|contains: ' -vulnerable'
CommandLine|contains: 'auth -pfx'
CommandLine|contains: 'shadow auto'
CommandLine|contains: 'shadow list'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • -bloodhound
  • -ca-pfx
  • -dc-ip
  • -kirbi
  • -old-bloodhound
  • -pfx
  • -target
  • -template
  • -username
  • -vulnerable
  • account
  • auth
  • cert
  • find
  • forge
  • ptt
  • relay corpus 2 (sigma 2)
  • req
  • shadow
  • template
  • auth -pfx
  • shadow auto
  • shadow list
Descriptionmatch
  • Certipy
Imageends_with
  • \Certipy.exe corpus 2 (sigma 2)
OriginalFileNameeq
  • Certipy.exe