Certificate Use With No Strong Mapping

Description

Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID) This could be a sign of exploitation of the elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping. Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing.

Query · sigma

selection:
  Provider_Name:
  - Kerberos-Key-Distribution-Center
  - Microsoft-Windows-Kerberos-Key-Distribution-Center
  EventID:
  - 39
  - 41
condition: selection

Known false positives

  • If prevalent in the environment, filter on events where the AccountName and CN of the Subject do not reference the same user
  • If prevalent in the environment, filter on CNs that end in a dollar sign indicating it is a machine name
Raw source Certificate Use With No Strong Mapping · Sigma
Esc
Published by SigmaHQ/sigma ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
title: Certificate Use With No Strong Mapping
id: 993c2665-e6ef-40e3-a62a-e1a97686af79
status: test
description: |
    Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID)
    This could be a sign of exploitation of the elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping.
    Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing.
references:
    - https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16
author: '@br4dy5'
date: 2023-10-09
modified: 2025-09-22
tags:
    - attack.privilege-escalation
logsource:
    product: windows
    service: system
detection:
    selection:
        Provider_Name:
            - 'Kerberos-Key-Distribution-Center'
            - 'Microsoft-Windows-Kerberos-Key-Distribution-Center'
        EventID:
            - 39
            - 41 # For Windows Server 2008 R2 SP1 and Windows Server 2008 SP2
    condition: selection
falsepositives:
    - If prevalent in the environment, filter on events where the AccountName and CN of the Subject do not reference the same user
    - If prevalent in the environment, filter on CNs that end in a dollar sign indicating it is a machine name
level: medium

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.