HackTool - Certify Execution

About the rule

Rule Type

Standard

Rule Description

Detects suspicious enumeration or certificate requests against Active Directory Certificate Services (AD CS) using the Certify tool, which attackers often leverage to identify vulnerable certificate templates and escalate privileges.

Severity

Trouble

Rule journey

Attack chain scenario

Discovery → AD CS Enumeration with Certify.exe → Abuse of Certificate Templates → Credential Access via Forged Certificates

Impact

If successful, the attacker can exploit misconfigured Active Directory Certificate Services (AD CS) to escalate privileges, impersonate domain users or administrators, and gain persistent access to critical systems. This can lead to complete domain compromise, data exfiltration, and long-term unauthorized access using forged certificates.

Rule Requirement

Prerequisites

Using Windows Event Viewer

1. Log in to a Domain Controller with domain admin credentials.
2. Open Group Policy Management Console (gpmc.msc).
3. Edit or create a GPO linked to the target OU.
4. Navigate to:
   Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Detailed Tracking
   • Enable Audit Process Creation (Success)
   • Enable Audit Process Termination (Success)
5. Navigate to:
   Computer Configuration > Administrative Templates > System > Audit Process Creation
   • Enable Include command line in process creation events
6. Ensure the registry key exists:
   Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-Security-Auditing\Operational

Using Sysmon

• Download and install Sysmon from Microsoft Sysinternals.
• Open Command Prompt as administrator.
• Use or create a Sysmon config file that monitors process creation.
• Install Sysmon using: sysmon.exe -i [configfile.xml]
• Example config entry: <ProcessCreate onmatch="exclude"/>
• Ensure the registry key exists:
  Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-Sysmon\Operational

Criteria

Detection

Execution Mode

realtime

Log Sources

Active Directory

MITRE ATT&CK

Execution: Exploitation for Client Execution (T1203)

Security Standards

NIST SP 800-53: SI-4, AU-12
ISO/IEC 27001: A.12.4.1

Author

pH-T (Nextron Systems)

Future actions

Known False Positives

Legitimate administrative use of Certify during AD CS troubleshooting

Next Steps

• Review the process creation logs from domain controllers.
• Investigate the command line input for suspicious keywords.
• Correlate with user behavior and lateral movement attempts.
• If activity is confirmed malicious, terminate the process and isolate the host.
• Update detection rules or threat intel if needed.

Mitigation

-