Compromission via l’AD CS : 2026, here we go again

title: Potential Certighost Client Domain Controller Spoofing 

id: 1ff9d058-8aac-4f16-8177-83985fbdae9d 

status: stable 

description: | 

  Detects ADCS certificate issuance (Event ID 4887) where the certificate request 

  contains a CDC attribute that does not match an approved Domain Controller. 

references: 

  - https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26 

  - https://github.com/aniqfakhrul/CVE-2026-54121 

author: OWN-CERT 

date: 2026-07-31 

logsource: 

  product: windows 

  service: security 

 

detection: 

  selection: 

    EventID: 4887 

    event_data.Attributes|contains: 'cdc:' 

 

  filter_legitimate_dc: 

    event_data.Attributes|contains: 

      - 'cdc:LAB-SRV-AD01.LABVULN.local' 

 

  condition: selection and not filter_legitimate_dc 

 

level: high 

tags: 

  - attack.credential-access 

  - attack.t1649 

python certighost_hunting.py LABVULN-LAB-SRV-PKI01-CA-1.edb 

 

================================================================================ 

Date UTC   : 2026-08-01T19:06:42.319000Z 

Requester  : LABVULN\GHOSTTUQGTJOQ$ 

CDC        : 192.168.100.190 

Template   :  

Request ID : 2 

================================================================================ 

Date UTC   : 2026-08-01T19:08:34.318000Z 

Requester  : LABVULN\GHOSTNIZLRRCI$ 

CDC        : 192.168.100.190 

Template   :  

Request ID : 3 

================================================================================ 

Date UTC   : 2026-08-01T19:09:47.038000Z 

Requester  : LABVULN\LAB-SRV-AD01$ 

CDC        : LAB-SRV-AD01.LABVULN.local 

Template   : 

Request ID : 4 

================================================================================ 

Date UTC   : 2026-08-01T19:10:29.806000Z 

Requester  : LABVULN\GHOSTXTSVKJNN$ 

CDC        : 192.168.100.190 

Template   : 

Request ID : 5 

================================================================================ 

Date UTC   : 2026-08-01T20:01:29.140000Z 

Requester  : LABVULN\GHOSTXPIKCIYR$ 

CDC        : 192.168.100.190 

Template   : 

Request ID : 6 

================================================================================ 

Date UTC   : 2026-08-01T20:06:02.174000Z 

Requester  : LABVULN\GHOSTAJIYXKJJ$ 

CDC        : 192.168.100.190 

Template   : 

Request ID : 7 

================================================================================ 

Date UTC   : 2026-08-02T18:04:45.240000Z 

Requester  : LABVULN\GHOSTYNECLZQN$ 

CDC        : 192.168.100.190 

Template   : 

Request ID : 8 

 

================================================================================ 

TOP CDC VALUES 

================================================================================ 

Rank  CDC value                                     Occurrences     Score 

-------------------------------------------------------------------------------- 

1     192.168.100.190                                         6     85.7% 

2     LAB-SRV-AD01.LABVULN.local                              1     14.3% 

-------------------------------------------------------------------------------- 

Total requests with cdc: 7 

Unique cdc values       : 2 

import sys 

from collections import Counter 

from datetime import datetime, timedelta, timezone 

 

import pyesedb 

 

 

def read_string(record, index): 

    try: 

        return record.get_value_data_as_string(index).rstrip("\x00") 

    except Exception: 

        value = record.get_value_data(index) 

        if isinstance(value, bytes): 

            return value.hex() 

        return str(value or "") 

 

 

def read_integer(record, index): 

    try: 

        return record.get_value_data_as_integer(index) 

    except Exception: 

        value = record.get_value_data(index) 

 

        if isinstance(value, bytes): 

            return int.from_bytes(value, "little") 

 

        return int(value) 

 

 

def get_row(table, row_index): 

    record = table.get_record(row_index) 

    row = {} 

 

    text_columns = { 

        "attributename", 

        "attributevalue", 

        "requestername", 

        "certificatetemplate", 

    } 

 

    for index in range(record.number_of_values): 

        name = record.get_column_name(index) 

        normalized = name.lstrip("$").lower() 

 

        if normalized == "requestid": 

            row[name] = read_integer(record, index) 

        elif normalized in text_columns: 

            row[name] = read_string(record, index) 

        else: 

            try: 

                row[name] = record.get_value_data(index) 

            except Exception: 

                row[name] = None 

 

    return row 

 

 

def get_value(row, name): 

    for key, value in row.items(): 

        if key.lstrip("$").lower() == name.lower(): 

            return value 

    return None 

 

 

def format_utc(value): 

    if value is None: 

        return "" 

    if isinstance(value, bytes) and len(value) == 8: 

        filetime = int.from_bytes(value, byteorder="little", signed=False) 

        date = datetime(1601, 1, 1, tzinfo=timezone.utc) + timedelta( 

            microseconds=filetime // 10 

        ) 

        return date.isoformat().replace("+00:00", "Z") 

 

    if isinstance(value, datetime): 

        if value.tzinfo is None: 

            value = value.replace(tzinfo=timezone.utc) 

        else: 

            value = value.astimezone(timezone.utc) 

        return value.isoformat().replace("+00:00", "Z") 

 

    return str(value) 

 

 

def get_table(database, name): 

    for index in range(database.number_of_tables): 

        table = database.get_table(index) 

        if table.name.lower() == name.lower(): 

            return table 

         

    raise RuntimeError(f"Table not found: {name}") 

 

 

def main(edb_path): 

    database = pyesedb.file() 

    database.open(edb_path) 

 

    cdc_counter = Counter() 

 

    try: 

        attributes = get_table(database, "RequestAttributes") 

        requests = get_table(database, "Requests") 

 

        requests_by_id = {} 

 

        for index in range(requests.number_of_records): 

            row = get_row(requests, index) 

            request_id = get_value(row, "RequestID") 

 

            if request_id is not None: 

                requests_by_id[request_id] = row 

 

        found = 0 

 

        for index in range(attributes.number_of_records): 

            row = get_row(attributes, index) 

 

            attribute_name = str( 

                get_value(row, "AttributeName") or "" 

            ).strip().rstrip(":").lower() 

 

            if attribute_name != "cdc": 

                continue 

 

            request_id = get_value(row, "RequestID") 

            cdc_value = str( 

                get_value(row, "AttributeValue") or "" 

            ).strip() 

 

            request = requests_by_id.get(request_id, {}) 

 

            requester = get_value(request, "RequesterName") or "" 

            template = get_value(request, "CertificateTemplate") or "" 

 

            date = ( 

                get_value(request, "SubmittedWhen") 

                or get_value(request, "RequestDate") 

                or get_value(request, "RequestTime") 

            ) 

 

            found += 1 

            cdc_counter[cdc_value] += 1 

 

            print("=" * 80) 

            print(f"Date UTC   : {format_utc(date)}") 

            print(f"Requester  : {requester}") 

            print(f"CDC        : {cdc_value}") 

            print(f"Template   : {template}") 

            print(f"Request ID : {request_id}") 

 

        if found == 0: 

            print("No request containing a cdc attribute was found.") 

            return 

 

        print("\n" + "=" * 80) 

        print("TOP CDC VALUES") 

        print("=" * 80) 

        print(f"{'Rank':<6}{'CDC value':<45}{'Occurrences':>12}{'Score':>10}") 

        print("-" * 80) 

 

        total = sum(cdc_counter.values()) 

 

        for rank, (cdc_value, occurrences) in enumerate( 

            cdc_counter.most_common(), 

            start=1, 

        ): 

            score = occurrences / total * 100 

 

            print( 

                f"{rank:<6}" 

                f"{cdc_value:<45}" 

                f"{occurrences:>12}" 

                f"{score:>9.1f}%" 

            ) 

 

        print("-" * 80) 

        print(f"Total requests with cdc: {total}") 

        print(f"Unique cdc values       : {len(cdc_counter)}") 

 

    finally: 

        database.close() 

 

 

if __name__ == "__main__": 

    if len(sys.argv) != 2: 

        print(f"Usage: python {sys.argv[0]} <CA_database.edb>") 

        sys.exit(1) 

 

    main(sys.argv[1])