
title: ADCS Certificate Template Configuration Vulnerability
author: Orlinum , BlueDefenZer
date: 2021/11/17
description: Detects certificate creation with template allowing risk permission subject
detection:
  SELECTION_1:
    EventID: 4898
  SELECTION_2:
    TemplateContent: '*CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT*'
  SELECTION_3:
    EventID: 4899
  SELECTION_4:
    NewTemplateContent: '*CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT*'
  condition: ((SELECTION_1 and SELECTION_2) or (SELECTION_3 and SELECTION_4))
falsepositives:
- Administrator activity
- Penetration tests
- Proxy SSL certificate with subject modification
- Smart card enrollement
id: 5ee3a654-372f-11ec-8d3d-0242ac130003
level: low
logsource:
  definition: Certificate services loaded a template would trigger event ID 4898 and
    certificate Services template was updated would trigger event ID 4899. A risk
    permission seems to be comming if template contain specific flag.
  product: windows
  service: security
references:
- https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf
status: experimental
tags:
- attack.privilege_escalation
- attack.credential_access
ruletype: SIGMA
