
title: ADCS Certificate Template Configuration Vulnerability with Risky EKU
author: Orlinum , BlueDefenZer
date: 2021/11/17
description: Detects certificate creation with template allowing risk permission subject
  and risky EKU
detection:
  SELECTION_1:
    EventID: 4898
  SELECTION_2:
    TemplateContent:
    - '*1.3.6.1.5.5.7.3.2*'
    - '*1.3.6.1.5.2.3.4*'
    - '*1.3.6.1.4.1.311.20.2.2*'
    - '*2.5.29.37.0*'
  SELECTION_3:
    TemplateContent: '*CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT*'
  SELECTION_4:
    EventID: 4899
  SELECTION_5:
    NewTemplateContent:
    - '*1.3.6.1.5.5.7.3.2*'
    - '*1.3.6.1.5.2.3.4*'
    - '*1.3.6.1.4.1.311.20.2.2*'
    - '*2.5.29.37.0*'
  SELECTION_6:
    NewTemplateContent: '*CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT*'
  condition: ((SELECTION_1 and SELECTION_2 and SELECTION_3) or (SELECTION_4 and SELECTION_5
    and SELECTION_6))
falsepositives:
- Administrator activity
- Penetration tests
- Proxy SSL certificate with subject modification
- Smart card enrollement
id: bfbd3291-de87-4b7c-88a2-d6a5deb28668
level: high
logsource:
  definition: Certificate services loaded a template would trigger event ID 4898 and
    certificate Services template was updated would trigger event ID 4899. A risk
    permission seems to be comming if template contain specific flag with risky EKU.
  product: windows
  service: security
references:
- https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf
status: experimental
tags:
- attack.privilege_escalation
- attack.credential_access
ruletype: SIGMA
