Query: detect Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mappin in logs
Matching passage: Sigma rule: Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mappin. Logsource: windows / system. Rule: title: Certificate Use With No Strong Mapping id: 993c2665-e6ef-40e3-a62a-e1a97686af79 status: test description: 'Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID) This could be a sign of exploitation of the elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping. Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing. ' references: - https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16 author: '@br4dy5' date: 2023-10-09 modified: 2025-09-22 tags: - attack.privilege-escalation logsource: product: windows service: system detection: selection: Provider_Name: - Kerberos-Key-Distribution-Center - Microsoft-Windows-Kerberos-Key-Distribution-Center EventID: - 39 - 41 condition: selection falsepositives: - If prevalent in the environment, filter on events where the AccountName and CN of the Subject do not reference the same user - If prevalent in the environment, filter on CNs that end in a dollar sign indicating it is a machine name level: medium
Near-miss passage: Sigma rule: Detects potentially suspicious CommandLine of electron apps (teams, discord, slack, etc.). This could be a sign of abuse. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Electron Application CommandLine id: 378a05d8-963c-46c9-bcce-13c7657eac99 related: - id: f26eb764-fd89-464b-85e2-dc4a8e6e77b8 type: similar status: test description: Detects potentially suspicious CommandLine of electron apps (teams, discord, slack, etc.). This could be a sign of abuse to proxy execution through a signed binary. references: - https://positive.security/blog/ms-officecmd-rce - https://lolbas-project.github.io/lolbas/Binaries/Teams/ - https://lolbas-project.github.io/lolbas/Binaries/Msedge/ - https://lolbas-project.github.io/lolbas/Binaries/msedgewebview2/ - https://medium.com/@MalFuzzer/one-electron-to-rule-them-all-dc2e9b263daf - https://chromium.googlesource.com/chromium/chromium/+/master/content/public/common/content_switches.cc author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-09-05 modified: 2023-11-09 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \chrome.exe - \code.exe - \discord.exe - \GitHubDesktop.exe - \keybase.exe - \msedge_proxy.exe - \msedge.exe - \msedgewebview2.exe - \msteams.exe - \slack.exe - \Teams.exe - OriginalFileName: - chrome.exe - code.exe - discord.exe - GitHubDesktop.exe - keybase.exe - msedge_proxy.exe - msedge.exe - msedgewebview2.exe - msteams.exe - slack.exe - Teams.exe selection_cli: CommandLine|contains: - --browser-subprocess-path - --gpu-launcher - --renderer-cmd-prefix - --utility-cmd-prefix condition: all of selection_* falsepositives: - Legitimate usage for debugging purposes level: medium