{"id":"762f2482-ff21-4970-8939-0aa317a886bb","title":"HackTool - Certify Execution","description":"Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command line arguments.","author":"pH-T (Nextron Systems)","status":"test","level":"high","date":"2023-04-17","modified":"2023-04-25","tags":["attack.discovery","attack.credential-access","attack.t1649"],"technique_ids":["T1649"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/GhostPack/Certify"],"source_path":"rules/windows/process_creation/proc_creation_win_hktl_certify.yml","source_sha256":"003bcf98e93205889ba172b571f6a6a71314cc05d320e2d2b5142d388a1f3291","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_certify.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: HackTool - Certify Execution\nid: 762f2482-ff21-4970-8939-0aa317a886bb\nstatus: test\ndescription: Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command line arguments.\nreferences:\n    - https://github.com/GhostPack/Certify\nauthor: pH-T (Nextron Systems)\ndate: 2023-04-17\nmodified: 2023-04-25\ntags:\n    - attack.discovery\n    - attack.credential-access\n    - attack.t1649\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\Certify.exe'\n        - OriginalFileName: 'Certify.exe'\n        - Description|contains: 'Certify'\n    selection_cli_commands:\n        CommandLine|contains:\n            - '.exe cas '\n            - '.exe find '\n            - '.exe pkiobjects '\n            - '.exe request '\n            - '.exe download '\n    selection_cli_options:\n        CommandLine|contains:\n            - ' /vulnerable'\n            - ' /template:'\n            - ' /altname:'\n            - ' /domain:'\n            - ' /path:'\n            - ' /ca:'\n    condition: selection_img or all of selection_cli_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1649","id":"T1649","name":"Steal or Forge Authentication Certificates","page":"techniques/enterprise/T1649/"}],"data_path":"data/detection-rules/762f2482-ff21-4970-8939-0aa317a886bb.json","kind":"sigma"}