Certighost — CVE-2026-54121 · AD CS Domain-Controller Impersonation

The attacker objective is the krbtgt secret, and the path to it runs through your Certification Authority rather than through a Domain Controller. Certighost (CVE-2026-54121, CVSS 8.8, CWE-285 improper authorization) lets any account that can log into the domain obtain a CA-signed certificate that authenticates as a Domain Controller. From there the attacker uses PKINIT to get Kerberos credentials for that DC account, and because DC accounts hold directory replication rights, runs DCSync to pull krbtgt. That is full domain compromise starting from an ordinary user.

The vulnerable behaviour is an optional AD CS enrollment fallback the reporters call a chase. During enrollment the CA may perform a second directory lookup on another host, and the requester gets to name that host through two certificate request attributes: cdc (Client DC — which server the CA contacts) and rmd (Remote Domain — which principal the CA looks up). Before the July 2026 update, the CA never checked that the cdc host was actually a Domain Controller. An attacker stands up rogue SMB/LSA and LDAP services, points cdc at them, and the CA accepts whatever identity data comes back.

The reason the rogue endpoint clears the CA's authentication checks at all is the default ms-DS-MachineAccountQuota of 10: a machine account created by an ordinary user is a valid domain principal, so it can satisfy the checks the CA needs to proceed even though it is not the DC being impersonated. Microsoft shipped the fix on 14 July 2026 (a validation routine that confirms the chase target really is a DC object with a matching DNS name and the SERVER_TRUST_ACCOUNT flag). Researchers H0j3n and Aniq Fakhrul published full technical details and a working certighost.py PoC on 24 July 2026.

Highest-value defensive angle

There is no published C2 infrastructure, no malware family and no attributed actor — so an IOC-first response buys you nothing here. The leverage is in three places, in this order: (1) patch every Enterprise CA; (2) set ms-DS-MachineAccountQuota to 0, which removes the primitive the whole chain is built on; (3) alert on the CA talking SMB/LDAP to anything that is not a Domain Controller, which is the single most specific signal this attack produces and which stays useful even after patching, because it also catches other AD CS relay abuse.

Defender priority: a CA server initiating an outbound SMB (445) or LDAP (389) connection to a host that is not on your Domain Controller list is the detection to build first. It is low-volume, it is the exact mechanic of the chase, and unlike a hash or a domain it cannot be changed by rotating infrastructure.

Ten sources were fetched and snapshotted to Certighost-CVE-2026-54121-ADCS-Hunt-sources/ on 2026-07-30. Every atomic indicator this pack ships is traceable to one of them; everything else is behavioral by design.

Dropped source: the DarkReading article on this flaw returned HTTP 403 to an unauthenticated fetch. Because no snapshot could be saved, it is not cited anywhere in this pack and contributed nothing to it.

Injection check: every fetched page was treated as untrusted data. None of the ten snapshots contained text attempting to direct an automated agent (no "fetch this other URL for the real IOCs", no claimed prior authorisation, no instructions to run commands). Nothing was dropped for that reason.

Hunt hypotheses

1. H1 — Quota abuse: a non-provisioning user account created one or more machine accounts in the last 90 days.
2. H2 — Chase egress: an Enterprise CA host opened SMB or LDAP to a host outside the Domain Controller set.
3. H3 — Rogue listener: a workstation or member server is listening on 389/636 (LDAP) or serving SMB from a non-system process.
4. H4 — Tooling: Python, certighost.py, Certipy, Rubeus or Impacket secretsdump ran on a non-admin endpoint.
5. H5 — Credential material: .pfx or .ccache artifacts or KRB5CCNAME appear in command lines outside the PKI team's hosts.
6. H6 — Replication abuse: a machine account authenticated from a host that is not that machine, followed by directory replication activity.
7. H7 — Mitigation tampering: certutil -setreg policy\EditFlags or a CertSvc restart occurred outside a change window (either the mitigation being applied, or an attacker re-enabling the chase).

Attack chain

Timing: steps 2 through 8 complete in minutes in the published PoC. Treat any single confirmed hit on Q2 or Q3 as an incident, not as a hunting lead.

IOC honesty note. This is a vulnerability-plus-public-PoC pack. No vendor has published C2 domains, IP addresses or file hashes for Certighost, and none are invented here. The table below is deliberately short; the detection value lives in sections 7 and 8. Anything you would normally expect as an atomic indicator appears as a clearly labelled REPLACE_WITH_ placeholder for you to fill from your own environment.

These run on Windows event data and CA logs. Several of them are the only way to see the request attributes themselves, because EDR network telemetry shows the chase connection but not the cdc value that caused it.

No in-query time filters. Every query below sets its intended window as a // LOOKBACK: comment and relies on the console time picker. That is deliberate — a @timestamp comparison against a function call is rejected by the CQL parser and would break the query on line 1.

// HUNT: Certighost step 2 - machine account created under the default ms-DS-MachineAccountQuota
// MITRE: T1136.002 | CONF: medium  FP: medium  COST: low | REQUIRES: Falcon Identity Protection (AD event stream)
// LOOKBACK: 90d - set the window in the console time picker, not in the query
// ⚠ validate in tenant: ActiveDirectoryAccountCreated is a Falcon Identity Protection event; its
// ⚠ validate in tenant: field naming is schema-version dependent - confirm SamAccountName /
// ⚠ validate in tenant: AccountDomain / UserName exist on a sample row before scheduling this.
#event_simpleName=/^ActiveDirectoryAccountCreated$/
| SamAccountName=/\$$/
// TUNING: replace this list with YOUR provisioning identities before running - untuned this returns every normal domain join
| UserName!=/^(svc-join|sccm|mdt|intune|autopilot|vdi-provision)/i
| groupBy([UserName, AccountDomain, SamAccountName, ComputerName], function=count(as=Created), limit=500)
| sort(Created, order=desc, limit=200)

// HUNT: Certighost step 5 - AD CS "chase" egress from the Certification Authority to a host that is not a DC
// MITRE: T1649 | CONF: high  FP: medium  COST: medium | REQUIRES: NetworkConnectIP4 from CA hosts
// LOOKBACK: 30d - set the window in the console time picker
#event_simpleName=/^NetworkConnectIP4$/
| ContextBaseFileName=/^(certsrv\.exe|lsass\.exe|svchost\.exe)$/i
| in(RemotePort, values=[389, 445, 636, 3268, 3269])
// TUNING: 1) narrow ComputerName to YOUR Enterprise CA hosts. 2) exclude every Domain Controller subnet.
// TUNING: both placeholders below are mandatory - untuned this returns all normal CA-to-DC traffic.
| ComputerName=/^REPLACE_WITH_CA_HOSTNAME_PREFIX/i
| !cidr(RemoteAddressIP4, subnet=["10.10.10.0/24", "10.10.20.0/24"])
| groupBy([ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort], function=count(as=Conns), limit=500)
| sort(Conns, order=desc, limit=200)

// HUNT: Certighost step 3 - rogue LDAP/SMB/LSA listener used as the chase endpoint
// MITRE: T1087.002 | CONF: high  FP: medium  COST: low | REQUIRES: NetworkListenIP4 (confirm it is enabled in sensor policy)
// LOOKBACK: 30d - set the window in the console time picker
#event_simpleName=/^NetworkListenIP4$/
| in(LocalPort, values=[389, 445, 636])
| ContextBaseFileName!=/^(System|lsass\.exe|ntoskrnl\.exe|dfsrs\.exe)$/i
// TUNING: exclude Domain Controllers and any sanctioned AD LDS / LDAP appliance hosts by ComputerName,
// TUNING: and exclude python only if you genuinely run an LDAP service on Python somewhere.
| groupBy([ComputerName, aid, ContextBaseFileName, LocalPort, LocalAddressIP4], function=count(as=Listens), limit=500)
| sort(Listens, order=desc, limit=200)

// HUNT: Certighost PoC tooling execution (certighost.py or a python interpreter invoking it)
// MITRE: T1649 | CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2
// LOOKBACK: 90d - set the window in the console time picker
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(certighost(\.py)?|python3?(\.exe)?|pythonw\.exe)$/i
| CommandLine=/(certighost|cve.2026.54121)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, SHA256HashData])
| sort(@timestamp, order=desc, limit=200)

// HUNT: Certighost step 8 - DCSync / replication tooling after DC impersonation
// MITRE: T1003.006 | CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2
// LOOKBACK: 90d - set the window in the console time picker
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/(secretsdump|just.dc.ntlm|just.dc\b|ntlmrelayx|addcomputer|dcsync|drsuapi)/i
| table([@timestamp, ComputerName, UserName, UserSid, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc, limit=200)

// HUNT: EDITF_ENABLECHASECLIENTDC policy-flag change or CertSvc restart on a CA host
// MITRE: T1562.001 | CONF: medium  FP: medium  COST: low | REQUIRES: ProcessRollup2
// LOOKBACK: 90d - set the window in the console time picker
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(certutil\.exe|sc\.exe|net\.exe|powershell\.exe|pwsh\.exe)$/i
| CommandLine=/(EDITF_ENABLECHASECLIENTDC|setreg\s+policy.EditFlags|(Restart|Stop|Start).Service\s+CertSvc)/i
// TUNING: expected during patch/mitigation windows - correlate UserName against your PKI change record
// TUNING: rather than excluding hosts, and alert only on runs outside an approved window.
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc, limit=200)

// HUNT: Certighost step 7 - machine (DC) account authenticating from an unexpected endpoint
// MITRE: T1550.003 | CONF: medium  FP: high  COST: medium | REQUIRES: UserLogon
// LOOKBACK: 14d - set the window in the console time picker; keep this one narrow
#event_simpleName=/^UserLogon$/
| UserName=/\$$/
| LogonType=3
// TUNING: mandatory - restrict UserName to your Domain Controller accounts, then verify each
// TUNING: ComputerName in the results IS that DC. Any other host in the list is the finding.
| UserName=/^REPLACE_WITH_DC_ACCOUNT_PREFIX/i
| groupBy([UserName, ComputerName, aid, UserSid, LogonType], function=count(as=Logons), limit=500)
| sort(Logons, order=asc, limit=200)

// HUNT: certificate/ticket artifacts and AD CS abuse tooling on an endpoint
// MITRE: T1558 | CONF: medium  FP: medium  COST: low | REQUIRES: ProcessRollup2
// LOOKBACK: 90d - set the window in the console time picker
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/(KRB5CCNAME|\.ccache|\.pfx|certipy|Certify\.exe|Rubeus|asktgt|getTGT)/i
// TUNING: exclude your PKI administration jump hosts and code-signing build agents, which touch
// TUNING: .pfx files as normal business - everything else on this list deserves a look.
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc, limit=200)

// HUNT: Certighost setup correlation - machine-account creation AND a rogue directory listener on one aid
// MITRE: T1136.002 | CONF: high  FP: low  COST: medium | REQUIRES: Identity Protection + NetworkListenIP4
// LOOKBACK: 30d - set the window in the console time picker
// ⚠ validate in tenant: ActiveDirectoryAccountCreated is a Falcon Identity Protection event -
// ⚠ validate in tenant: confirm it is present in your repo before relying on this correlation.
#event_simpleName=/ActiveDirectoryAccountCreated|NetworkListenIP4/
| selfJoinFilter(field=[aid], where=[
    {#event_simpleName=/ActiveDirectoryAccountCreated/},
    {#event_simpleName=/NetworkListenIP4/}
  ])
| in(LocalPort, values=[389, 445, 636])
| groupBy([aid, ComputerName], function=[count(as=Events), collect([UserName, SamAccountName, LocalPort, ContextBaseFileName])], limit=200)
| sort(Events, order=desc, limit=100)

// HUNT: baseline of machine-account creators - builds the exclusion list Q1 depends on
// MITRE: T1136.002 | CONF: medium  FP: medium  COST: low | REQUIRES: Falcon Identity Protection (AD event stream)
// LOOKBACK: 365d - set the window in the console time picker
// ⚠ validate in tenant: ActiveDirectoryAccountCreated is a Falcon Identity Protection event and its
// ⚠ validate in tenant: field naming is schema-version dependent - check a sample row first.
#event_simpleName=/^ActiveDirectoryAccountCreated$/
| SamAccountName=/\$$/
// TUNING: this query is expected to be noisy - it is a baseline, not an alert. Promote only the
// TUNING: identities with a FirstSeen inside the last 30 days and a Creations count in single digits.
| groupBy([UserName, AccountDomain], function=[count(as=Creations), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen), collect(SamAccountName)], limit=500)
| sort(FirstSeen, order=desc, limit=200)

Deployment path: Falcon console → Endpoint security → Custom IOA rule groups → create a group scoped to a host group containing your CAs and Domain Controllers first, run it in Monitor mode for 7 days, then widen to the full estate and promote the first two rules to Block.

Do not build an IOA on the .pfx extension alone. It is common in legitimate PKI and code-signing work and will generate more noise than the entire rest of this pack combined.

Four quick-copy blocks. The CSV is deliberately thin — see the honesty note in section 4. The behavioral and audit blocks are where the operational value is.

type,value,action,severity,expiration,description,tags
# Certighost is a vulnerability + public-PoC pack. No vendor has published C2 domains,
# IP addresses or file hashes, and none are invented here. The three rows below are the
# only atomic indicators that appear verbatim in a saved source snapshot; everything
# else in this pack is behavioral. Falcon IOC Management natively imports sha256/sha1/
# md5/domain/ipv4/ipv6 - the filename and port rows are hunt-list entries for your SIEM.
filename,certighost.py,hunt,high,2027-01-30,Certighost AD CS PoC exploit script,campaign:Certighost
port,389,hunt,medium,2026-10-30,LDAP - rogue chase listener and CA chase egress,campaign:Certighost
port,445,hunt,medium,2026-10-30,SMB and LSA - rogue chase listener and CA chase egress,campaign:Certighost
sha256,REPLACE_WITH_POC_SCRIPT_SHA256,detect,high,2027-01-30,Hash of the PoC as retrieved in your own validation,campaign:Certighost
ipv4,REPLACE_WITH_ROGUE_CHASE_HOST_IP,hunt,high,2026-10-30,Host named in an observed cdc request attribute,campaign:Certighost
domain,REPLACE_WITH_ROGUE_CHASE_HOSTNAME,hunt,high,2026-10-30,Hostname named in an observed cdc request attribute,campaign:Certighost

BEHAVIOR-01  Machine account created by an identity outside the provisioning set
BEHAVIOR-02  CA host opens SMB (445) or LDAP (389/636/3268) to an address that is not a DC
BEHAVIOR-03  LDAP listener (389 or 636) on a host that is not a Domain Controller
BEHAVIOR-04  SMB served from a process other than System on a workstation
BEHAVIOR-05  Certificate request carrying the cdc and rmd request attributes
BEHAVIOR-06  Certificate issued whose subject is a DC account, to a requester that is not that DC
BEHAVIOR-07  PKINIT TGT request for a machine account from a client address that is not that machine
BEHAVIOR-08  Directory replication (DsGetNCChanges) requested by a non-DC principal
BEHAVIOR-09  .pfx or .ccache path, or KRB5CCNAME, in a command line on a non-PKI host
BEHAVIOR-10  EditFlags policy change or CertSvc service restart outside a change window
BEHAVIOR-11  ms-DS-MachineAccountQuota modified on the domain object

certighost.py          public PoC script (renameable - hunt string, not a block)
aniqfakhrul/CVE-2026-54121   public PoC repository name cited across sources
secretsdump            Impacket module used for the DCSync step in the published chain
ntlmrelayx             Impacket relay tooling, same family
addcomputer            Impacket module for machine-account creation
certipy                third-party AD CS abuse toolkit (same attack class)
Certify.exe            .NET AD CS abuse tool (same attack class)
Rubeus / asktgt        Kerberos ticket request tooling used after certificate issuance
cdc                    certificate request attribute - names the chase target host
rmd                    certificate request attribute - names the principal to resolve
.pfx                   issued certificate written by the PoC
.ccache                Kerberos credential cache written by the PoC
KRB5CCNAME             environment variable pointing at the ticket cache

# 1. Inventory every Enterprise CA in the forest
Get-ADObject -Filter "objectClass -eq 'pKIEnrollmentService'" -SearchBase ("CN=Enrollment Services,CN=Public Key Services,CN=Services," + (Get-ADRootDSE).configurationNamingContext) -Properties dNSHostName | Select-Object Name,dNSHostName

# 2. Confirm the July 2026 update is installed on each CA (run per CA host)
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 15 HotFixID,InstalledOn

# 3. Read the CA policy EditFlags value (chase state) on each CA host
certutil -getreg policy\EditFlags

# 4. Read the domain machine-account quota
Get-ADObject -Identity (Get-ADDomain).DistinguishedName -Properties "ms-DS-MachineAccountQuota" | Select-Object -ExpandProperty "ms-DS-MachineAccountQuota"

# 5. List computer objects created in the last 90 days and who owns them
Get-ADComputer -Filter "whenCreated -gt '$((Get-Date).AddDays(-90).ToString('yyyy-MM-dd'))'" -Properties whenCreated,nTSecurityDescriptor | Select-Object Name,whenCreated,@{n='Owner';e={$_.nTSecurityDescriptor.Owner}}

# 6. Confirm Certification Services auditing is on (needed for events 4886/4887)
certutil -getreg CA\AuditFilter

Gate 1 — Telemetry ready

• NetworkConnectIP4 is flowing from every Enterprise CA host (check: any result at all for the CA hostnames in the last 24h).
• NetworkListenIP4 is enabled in the sensor policy applied to workstations — Q3 and Q9 silently return nothing if it is not.
• Falcon Identity Protection AD events are present, or Q1/Q9/Q10 must be replaced with the 4741-based native hunt N1.
• Certification Services auditing is enabled on the CA, or N2/N3 cannot run.

Gate 2 — Benign baseline

• Run Q10 over 365 days and record the full set of legitimate machine-account creators. Paste that set into Q1's exclusion regex.
• Run Q2 with only the CA-host filter applied (no CIDR exclusion) and record the DC addresses that appear. Those become the exclusion list.
• Run Q3 across the estate and record every host that legitimately listens on 389/636. Expect Domain Controllers and possibly an AD LDS host; anything else is a finding before you even get to Certighost.

Gate 3 — Positive tests (lab only)

• On an isolated lab domain, create a computer account with an ordinary user and confirm Q1 and N1 both fire.
• Bind a listener on 389 on a lab workstation and confirm Q3 fires and 5154 is logged.
• Run certutil -getreg policy\EditFlags and confirm Q6's pattern does not match a read (only -setreg should).

Gate 4 — Promotion

• Promote Q2 and Q4 to scheduled searches with alerting once Gate 2 is complete. Q4 needs no tuning.
• Q5 goes straight to alerting — it has no benign baseline in a normal estate.
• Q7 and Q10 stay as analyst-run hunts. Do not schedule them.

Do not promote Q1 before Gate 2. Untuned it returns every domain join in the estate, and an alert that fires on normal provisioning gets muted within a week — taking the one signal that catches step 2 with it.

Playbook 1 — Disable the AD CS chase fallback (temporary mitigation, per CA host)

# Run elevated ON EACH ENTERPRISE CA. This is the vendor/reporter-documented workaround
# for organisations that cannot install the July 2026 update immediately.
# It is a TEMPORARY measure: the reporters state it has not been fully tested in production,
# and it may interrupt legitimate cross-DC enrollment workflows. Patch as the real fix.

# 1. Record the current state first, so you can prove what changed and roll back.
certutil -getreg policy\EditFlags

# 2. Clear the EDITF_ENABLECHASECLIENTDC bit.
certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC

# 3. Restart the Certification Authority service for the change to take effect.
Restart-Service CertSvc -Force

# 4. Confirm the bit is gone and the service came back healthy.
certutil -getreg policy\EditFlags
Get-Service CertSvc | Select-Object Name,Status,StartType

# 5. Smoke-test enrollment from a normal client before you walk away.
certutil -pulse

Playbook 2 — Remove the machine-account creation primitive

# Run once per domain, from a Tier 0 admin workstation with the AD PowerShell module.

# 1. Record the current value.
$dn = (Get-ADDomain).DistinguishedName
Get-ADObject -Identity $dn -Properties "ms-DS-MachineAccountQuota" | Select-Object -ExpandProperty "ms-DS-MachineAccountQuota"

# 2. Set it to zero. Ordinary users can no longer create computer objects.
Set-ADDomain -Identity $dn -Replace @{"ms-DS-MachineAccountQuota"="0"}

# 3. Verify.
Get-ADObject -Identity $dn -Properties "ms-DS-MachineAccountQuota" | Select-Object -ExpandProperty "ms-DS-MachineAccountQuota"

# 4. BEFORE step 2 in production: confirm your join workflow does not rely on the quota.
#    Grant the provisioning identity an explicit delegation on the target OU instead, using
#    the AD Delegation of Control wizard: "Create, delete and manage computer accounts".
#    Autopilot / Intune / SCCM OSD / MDT all support a delegated join account.

# 5. Alert on any future change to this attribute (native hunt N7 - event 5136 on the domain object).

Playbook 3 — Turn on Certification Services auditing (enables 4886 / 4887)

# Run elevated ON EACH CA. Without this, the CA request/issue events Microsoft points at
# for this CVE are simply not generated, and native hunts N2 and N3 have no source data.

# 1. Enable the CA's own audit filter (all categories).
certutil -setreg CA\AuditFilter 127
Restart-Service CertSvc -Force

# 2. Enable the matching Windows audit subcategory.
auditpol /set /subcategory:"Certification Services" /success:enable /failure:enable

# 3. Verify both halves.
certutil -getreg CA\AuditFilter
auditpol /get /subcategory:"Certification Services"

# 4. Confirm events are landing.
Get-WinEvent -LogName Security -MaxEvents 50 -FilterXPath "*[System[(EventID=4886 or EventID=4887)]]" | Select-Object TimeCreated,Id

Playbook 4 — Review CA request rows for chase attributes

# Run ON THE CA. The request database is the only place the cdc / rmd attributes are visible.

# 1. Dump recent request rows with their attributes.
certutil -view -restrict "RequestID>0" -out "RequestID,RequesterName,Request.SubmittedWhen,Request.DispositionMessage,Request.RequestAttributes"

# 2. Scan that output for request attributes containing cdc or rmd, and for any request whose
#    issued subject is a Domain Controller account but whose RequesterName is not that DC.
#    Both are direct evidence of the Certighost pattern.

# 3. Any hit: capture the RequestID, the RequesterName, the cdc host value and the issued
#    certificate serial, then revoke that certificate and go to section 14.
certutil -revoke REPLACE_WITH_CERT_SERIAL 4

Playbook 5 — Restrict CA egress (converts detection into prevention)

# Windows Firewall outbound rules on the CA host. Adjust the DC address list to your estate.
# Rationale: a CA legitimately needs LDAP/SMB to Domain Controllers and to its CDP/AIA
# publishing share. Denying those ports to everything else removes the chase primitive
# regardless of patch state.

$dcs = @("10.10.10.11","10.10.10.12")   # REPLACE_WITH your Domain Controller addresses

New-NetFirewallRule -DisplayName "CA egress LDAP-SMB to DCs only (allow)" -Direction Outbound -Action Allow -Protocol TCP -RemotePort 389,445,636,3268,3269 -RemoteAddress $dcs

New-NetFirewallRule -DisplayName "CA egress LDAP-SMB block all others" -Direction Outbound -Action Block -Protocol TCP -RemotePort 389,445,636,3268,3269

# Verify, then watch Q2 for 48h - it should now return nothing at all.
Get-NetFirewallRule -DisplayName "CA egress*" | Select-Object DisplayName,Enabled,Action

krbtgt rotation is not optional if DCSync succeeded. The krbtgt secret is the master key for Kerberos in the domain; an attacker holding it can forge tickets for any principal indefinitely, and no amount of endpoint remediation touches that. Two rotations, with the vendor-recommended gap, is the minimum.

Named coverage gaps

• Certificate request attributes are invisible to EDR. Two of the eight chain steps can only be seen in the CA's own logs. If Certification Services auditing is off, those steps are entirely undetected. Playbook 3 is therefore a detection prerequisite, not hardening.
• No atomic infrastructure exists. There is nothing to block. A tenant that responds to this pack by importing the CSV and stopping has done essentially nothing.
• Identity Protection dependency. Q1, Q9 and Q10 need the Falcon Identity Protection AD event stream. Without that licence, fall back to native hunt N1 on 4741.
• NetworkListenIP4 coverage. Listen telemetry is not always enabled in workstation sensor policies. Verify before relying on Q3.

Validation gates (see section 11 for the full detail): telemetry readiness on the four sources above, a 365-day benign baseline from Q10 and a DC-address baseline from Q2, lab-only positive tests for Q1/Q3/Q6, and a promotion rule that puts Q2/Q4/Q5 on alerting while Q7 and Q10 stay as analyst-run hunts. Q1 must not be promoted before its exclusion list is built.

Every cited source above was captured as plain text into Certighost-CVE-2026-54121-ADCS-Hunt-sources/ alongside this file. The three atomic indicators in section 10's CSV each appear verbatim in at least one of those snapshots.