ADCS - Certighost CDC Chase Certificate Request (CVE-2026-54121)

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects Active Directory Certificate Services (ADCS) certificate requests that include the 'cdc' (Client DC) request attribute pointing to a domain or IP that is not a known Domain Controller. 'cdc' is an optional MS-WCCE enrollment attribute designed for cross-domain/cross-forest scenarios where a client in a child domain tells the CA which DC to contact for identity lookups when the CA cannot reach that domain directly. Legitimate values are DC hostnames or IPs that resolve to a real Domain Controller computer object in AD with the SERVER_TRUST_ACCOUNT (0x2000) userAccountControl bit set. In an attack, the attacker sets cdc to a domain or IP they control so the CA connects to their rogue SMB and LDAP services instead of a real DC. The rogue server returns a forged DC identity which the pre-patch CA accepts without validation. A malicious event looks like: Requester: DOMAIN\GHOST<random>$ Attributes: cdc:<attacker_ip> rmd:<target_dc_fqdn> SubjectAlternativeName: DNS Name=<target_dc_fqdn> CVE-2026-54121 (Certighost) is the known exploit for this path. The July 2026 patch added _ValidateChaseTargetIsDC which rejects cdc values that do not resolve to a legitimate DC object in Active Directory before following the chase.

2026-07-27 00:00:00

None

c4a1f389-2e6b-4d9a-8f0c-b73e5a12d947

attack.privilege-escalation attack.credential-access attack.t1649 cve.2026-54121 detection.emerging-threats

Community Rule

Swachchhanda Shrawan Poudel

Merge PR #6190 from @swachchhanda000 - Add CertiGhost Rules

2026-08-05