Query: detection rule: Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mappin
Matching passage: Sigma rule: Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mappin. Logsource: windows / system. Rule: title: Certificate Use With No Strong Mapping id: 993c2665-e6ef-40e3-a62a-e1a97686af79 status: test description: 'Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID) This could be a sign of exploitation of the elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping. Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing. ' references: - https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16 author: '@br4dy5' date: 2023-10-09 modified: 2025-09-22 tags: - attack.privilege-escalation logsource: product: windows service: system detection: selection: Provider_Name: - Kerberos-Key-Distribution-Center - Microsoft-Windows-Kerberos-Key-Distribution-Center EventID: - 39 - 41 condition: selection falsepositives: - If prevalent in the environment, filter on events where the AccountName and CN of the Subject do not reference the same user - If prevalent in the environment, filter on CNs that end in a dollar sign indicating it is a machine name level: medium
Near-miss passage: Sigma rule: Detects suspicious spawning of a process under a different user context than the parent process. Processes such as notep. Logsource: windows / process_creation. Rule: title: Suspicious Cross-User Process Spawn id: d2b7a134-9c3e-4f8a-b56d-e0c1f8a29b47 status: experimental description: 'Detects suspicious spawning of a process under a different user context than the parent process. Processes such as notepad.exe, calculator etc. are generally spawned under the same user context and also they are often targeted as sacrificial process or decoy process to check successful privilege escalation. ' references: - https://github.com/MSNightmare/LegacyHive - https://git.projectnightcrawler.dev/NightmareEclipse/LegacyHive author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-07-23 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 - attack.t1134 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \notepad.exe - \calc.exe - \mspaint.exe - \wordpad.exe - \write.exe filter_main_same_user: User|fieldref: ParentUser filter_optional_user_null: User: null filter_optional_parent_null: ParentUser: null filter_optional_empty_user: - ParentUser: - '' - '-' - User: - '' - '-' condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - RunAs usage spawning one of the listed binaries under a different account level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_susp_cross_user_process_spawn/info.yml