Analytics BIOC Low
✕

Suspicious Certutil AD CS contact

A suspicious occurrence of Certutil attempted to contact the AD CS Request Interface.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Discovery (TA0007) Credential Access (TA0006)
ATT&CK techniques: System Service Discovery (T1007) Steal or Forge Authentication Certificates (T1649)
Detector tags: Active Directory Certificate Services Analytics
Attacker's goals:

An attacker might look for AD CS servers, certificate templates or request certificates. With the wrong setting or loose vulnerable templates or enabled enrollment, the attacker will be able to authenticate as users on the network.

Investigative actions:

Look at further action done by the user. Investigate whether other non-standard operations were done regarding the AD CS.

Test period:
N/A (single event)
Deduplication:
1 Day
1 variation:
  • Suspicious Certutil AD CS Admin Interface contact Medium (parent: Low)