Analytics BIOC
Medium
✕
A machine certificate was issued with a mismatch
A machine certificate was issued with a mismatch between the requester and the subject.
- Module:
- Identity Analytics
- Data source:
- Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Privilege Escalation (TA0004)
ATT&CK techniques: Valid Accounts: Domain Accounts (T1078.002)
Detector tags: Active Directory Certificate Services Analytics
Attacker's goals:
An attacker may attempt to exploit the Active Directory Certificate Services to escalate privileges to a domain controller machine account.
Investigative actions:
Check who owns the certificate requester account. Check if the requester DNS name attribute was changed recently. Investigate actions done by the requester and its owner. Check for possible DCSync alerts.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day