CertiGhost (CVE-2026-54121) - Detection Engineering Writeup

CertiGhost (CVE-2026-54121) abuses certificate template misconfiguration and authentication anomalies to escalate privilege inside Active Directory. This page covers the lab work behind the detections in the linked repo. The repo itself has the full rules and root-cause writeup.

What I built

Set up a lab Active Directory environment and worked through the CertiGhost attack chain by hand: template abuse, the certificate request path, and the authentication anomalies it produces once a certificate gets misused for logon.

Detections

Built a Splunk detection targeting the AD CS certificate lifecycle events it generates (4886, 4887, 4888), anchored on the cdc chase-target attribute rather than machine account creation — covering both the default-MachineAccountQuota and attacker-controlled-account exploitation paths per Microsoft’s advisory. The remaining stages of the attack chain (DCSync, Golden Ticket, etc.) are scoped as a planned detection roadmap in the repo, not yet built.

Documentation

Every finding got written up as a forensic root-cause analysis and mapped to MITRE ATT&CK, so the detections trace back to a technique instead of just an event ID.

Full rules, queries, and writeup are in the repo linked above.