Unusual CertLog Remote File Write

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules	Identity Analytics
Detector Tags	Active Directory Certificate Services Analytics
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Steal or Forge Authentication Certificates (T1649)
Severity	Low

Description

A remote host wrote to a certificate log file via RPC over SMB, which may indicate the use of an AD CS attack tool like Certipy. This behavior is commonly associated with certificate-based authentication attacks.

Attacker's Goals

An attacker may be attempting to exploit AD CS misconfigurations and obtain forged authentication certificates for privilege escalation or persistence.

Investigative actions

• Determine whether this was a legitimate certificate request or an unauthorized write operation.
• Review logs for preceding and subsequent authentication attempts.
• Investigate the remote host for any suspicious activity.
• Identify any subsequent Kerberos ticket usage, such as forging or relaying attacks.

Variations

Suspicious CertLog Remote File Write

Synopsis

Field	Value
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Steal or Forge Authentication Certificates (T1649)
Severity	Medium

Description

A remote host wrote to a certificate log file via RPC over SMB, which may indicate the use of an AD CS attack tool like Certipy. This behavior is commonly associated with certificate-based authentication attacks.

Attacker's Goals

An attacker may be attempting to exploit AD CS misconfigurations and obtain forged authentication certificates for privilege escalation or persistence.

Investigative actions

• Determine whether this was a legitimate certificate request or an unauthorized write operation.
• Review logs for preceding and subsequent authentication attempts.
• Investigate the remote host for any suspicious activity.
• Identify any subsequent Kerberos ticket usage, such as forging or relaying attacks.