HackTool - Certipy Execution

Image

'\Certipy.exe'

OriginalFileName

'Certipy.exe'

Description

'Certipy'

CommandLine

' account '

' auth '

# - ' ca ' # Too short to be used with just one CLI

' cert '

' find '

' forge '

' ptt '

' relay '

' req '

' shadow '

' template '

' -bloodhound'

' -ca-pfx '

' -dc-ip '

' -kirbi'

' -old-bloodhound'

' -pfx '

' -target'

' -template'

' -username '

' -vulnerable'

'auth -pfx'

'shadow auto'

'shadow list'  

Detection Query 1 :

((resourcename = "Windows Security"  AND eventtype = "4688"  ) AND newprocessname = "\Certipy.exe"  ) AND winmessage In ("Certipy.exe","Certipy","account","auth","cert","find","forge","ptt","relay","req","shadow","template","-bloodhound","-ca-pfx","-dc-ip","-kirbi","-old-bloodhound","-pfx","-target","-template","-username","-vulnerable","auth -pfx","shadow auto","shadow list")

Detection Query 2 :

((technologygroup = "EDR" ) AND newprocessname = "\Certipy.exe"  ) AND winmessage In ("Certipy.exe","Certipy","account","auth","cert","find","forge","ptt","relay","req","shadow","template","-bloodhound","-ca-pfx","-dc-ip","-kirbi","-old-bloodhound","-pfx","-target","-template","-username","-vulnerable","auth -pfx","shadow auto","shadow list")

Detection Query 3 :

(resourcename = "Sysmon"  AND eventtype = "1"  ) AND image = "\Certipy.exe" AND originalfilename = "Certipy.exe" AND description like "Certipy"  AND commandline In ("account","auth","cert","find","forge","ptt","relay","req","shadow","template","-bloodhound","-ca-pfx","-dc-ip","-kirbi","-old-bloodhound","-pfx","-target","-template","-username","-vulnerable","auth -pfx","shadow auto","shadow list")

Detection Query 4 :

technologygroup = "EDR" AND image = "\Certipy.exe" AND originalfilename = "Certipy.exe" AND description like "Certipy"  AND commandline In ("account","auth","cert","find","forge","ptt","relay","req","shadow","template","-bloodhound","-ca-pfx","-dc-ip","-kirbi","-old-bloodhound","-pfx","-target","-template","-username","-vulnerable","auth -pfx","shadow auto","shadow list")