Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Create Suspicious_Access_Attempt_to_the_cert Windows_Share_Possible_C… #5073

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Create Suspicious_Access_Attempt_to_the_cert Windows_Share_Possible_C… #5073

wants to merge 1 commit into from
+25 −0

Conversation

NinnessOtu
Copy link

This rule detects attempts to access the Windows share IPC with the specific target name "cert," which could indicate unauthorized certificate requests. This behavior has been linked to tools such as Certipy.

@github-actions github-actions bot added Rules Windows Pull request add/update windows related rules labels Nov 7, 2024
github-actions[bot]
github-actions bot reviewed Nov 7, 2024
View reviewed changes
Copy link
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Welcome @NinnessOtu 👋

It looks like this is your first pull request on the Sigma rules repository!

Please make sure to read the SigmaHQ conventions document to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.

Thanks again, and welcome to the Sigma community! 😃

@nasbench
Copy link
Member

nasbench commented Nov 7, 2024

Hey @NinnessOtu and thanks for your contribution. Please provide logs evidence for EID 5145 as well as better context for why this is interesting to look for by providing perhaps actually references to blogs or sandboxes that made use of this technique.

@nasbench nasbench added Work In Progress Some changes are needed Author Input Required changes the require information from original author of the rules labels Nov 7, 2024
@nasbench nasbench marked this pull request as draft November 7, 2024 17:49
@NinnessOtu
Copy link
Author

NinnessOtu commented Nov 7, 2024 •
edited
Loading

hello @nasbench
actually during my research into the behavior of the Certipy tool, I discovered a particular aspect of how it operates.
When Certipy is used to make any certificate request, it communicates through the \pipe\cert pipe on AD CS.

For example, when running the following command:

certipy req -u sigmapoc -p P@ssword -dc-ip 10.0.10.180 -ca TCA01-CA -template ESC2_TEST -target TCA01.domain.LOCAL -debug

The output (from Certipy v4.8.2 by Oliver Lyak) provides details of the connection process:

[+] Trying to resolve 'TCA01.domain.LOCAL' at '10.0.10.182'
[+] Generating RSA key
[*] Requesting certificate via RPC
[+] Trying to connect to endpoint: ncacn_np:10.0.10.182[\pipe\cert]
[+] Connected to endpoint: ncacn_np:10.0.10.182[\pipe\cert]

Here are the logs :

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> 
  <EventID>5145</EventID> 
  <Version>0</Version> 
  <Level>0</Level> 
  <Task>12811</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8020000000000000</Keywords> 
  <TimeCreated SystemTime="2024-11-07T18:36:41.632462600Z" /> 
  <EventRecordID>211680</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="4" ThreadID="284" /> 
  <Channel>Security</Channel> 
  <Computer>TCA01.domain.LOCAL</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data Name="SubjectUserSid">S-1-5-21-1785001660-2072756767-72384860-1103</Data> 
  <Data Name="SubjectUserName">sigmapoc</Data> 
  <Data Name="SubjectDomainName">domain</Data> 
  <Data Name="SubjectLogonId">0x112e27</Data> 
  <Data Name="ObjectType">File</Data> 
  <Data Name="IpAddress">10.0.10.1</Data> 
  <Data Name="IpPort">39042</Data> 
  <Data Name="ShareName">\\*\IPC$</Data> 
  <Data Name="ShareLocalPath" /> 
  <Data Name="RelativeTargetName">cert</Data> 
  <Data Name="AccessMask">0x3</Data> 
  <Data Name="AccessList">%%4416 %%4417</Data> 
  <Data Name="AccessReason">-</Data> 
  </EventData>
  </Event

@NinnessOtu NinnessOtu marked this pull request as ready for review November 7, 2024 18:56
@nasbench nasbench removed the Author Input Required changes the require information from original author of the rules label Nov 13, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@github-actions github-actions[bot] github-actions[bot] left review comments

Assignees
No one assigned
Labels
Rules Windows Pull request add/update windows related rules Work In Progress Some changes are needed
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@NinnessOtu @nasbench