{"id":"6938366d-8954-4ddc-baff-c830b3ba8fcd","title":"HackTool - Certipy Execution","description":"Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments.\n","author":"pH-T (Nextron Systems), Sittikorn Sangrattanapitak","status":"test","level":"high","date":"2023-04-17","modified":"2024-10-08","tags":["attack.discovery","attack.credential-access","attack.t1649"],"technique_ids":["T1649"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unlikely"],"references":["https://github.com/ly4k/Certipy","https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-gui-new-authentication-and-request-methods-and-more-7237d88061f7"],"source_path":"rules/windows/process_creation/proc_creation_win_hktl_certipy.yml","source_sha256":"ba1ff0d2e5f412a81a653fd24a264894aa9821838ffad9620209a08471dca88a","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_certipy.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: HackTool - Certipy Execution\nid: 6938366d-8954-4ddc-baff-c830b3ba8fcd\nstatus: test\ndescription: |\n    Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments.\nreferences:\n    - https://github.com/ly4k/Certipy\n    - https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-gui-new-authentication-and-request-methods-and-more-7237d88061f7\nauthor: pH-T (Nextron Systems), Sittikorn Sangrattanapitak\ndate: 2023-04-17\nmodified: 2024-10-08\ntags:\n    - attack.discovery\n    - attack.credential-access\n    - attack.t1649\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\Certipy.exe'\n        - OriginalFileName: 'Certipy.exe'\n        - Description|contains: 'Certipy'\n    selection_cli_commands:\n        CommandLine|contains:\n            - ' account '\n            - ' auth '\n            # - ' ca ' # Too short to be used with just one CLI\n            - ' cert '\n            - ' find '\n            - ' forge '\n            - ' ptt '\n            - ' relay '\n            - ' req '\n            - ' shadow '\n            - ' template '\n    selection_cli_flags:\n        CommandLine|contains:\n            - ' -bloodhound'\n            - ' -ca-pfx '\n            - ' -dc-ip '\n            - ' -kirbi'\n            - ' -old-bloodhound'\n            - ' -pfx '\n            - ' -target'\n            - ' -template'\n            - ' -username '\n            - ' -vulnerable'\n            - 'auth -pfx'\n            - 'shadow auto'\n            - 'shadow list'\n    condition: selection_img or all of selection_cli_*\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1649","id":"T1649","name":"Steal or Forge Authentication Certificates","page":"techniques/enterprise/T1649/"}],"data_path":"data/detection-rules/6938366d-8954-4ddc-baff-c830b3ba8fcd.json","kind":"sigma"}