HackTool - ADCSPwn Execution

Title: HackTool - ADCSPwn Execution
Status: test
Description:Detects command line parameters used by ADCSPwn, a tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service
References:
  -https://github.com/bats3c/ADCSPwn
Author: Florian Roth (Nextron Systems)
Date: 2021-07-31
modified:2023-02-04
Tags:

• -'attack.collection'
• -'attack.credential-access'
• -'attack.t1557.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    CommandLine|contains|all:
      -' --adcs '
      -' --port '

  condition:selection
Falsepositives:
  -Unlikely
Level: high