Unusual CertLog Remote File Write

Cortex XSIAM Analytics Alert Reference by Alert name

Product

Cortex XSIAM

Last date published

2025-11-09

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules	Identity Analytics
Detector Tags	Active Directory Certificate Services Analytics
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Steal or Forge Authentication Certificates (T1649)
Severity	Low

Description

A remote host wrote to a certificate log file via RPC over SMB, which may indicate the use of an AD CS attack tool like Certipy. This behavior is commonly associated with certificate-based authentication attacks.

Attacker's Goals

An attacker may be attempting to exploit AD CS misconfigurations and obtain forged authentication certificates for privilege escalation or persistence.

Investigative actions

Determine whether this was a legitimate certificate request or an unauthorized write operation.
Review logs for preceding and subsequent authentication attempts.
Investigate the remote host for any suspicious activity.
Identify any subsequent Kerberos ticket usage, such as forging or relaying attacks.

Variations

Suspicious CertLog Remote File Write

Synopsis

ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Steal or Forge Authentication Certificates (T1649)
Severity	Medium

Description

Attacker's Goals

An attacker may be attempting to exploit AD CS misconfigurations and obtain forged authentication certificates for privilege escalation or persistence.

Investigative actions

Determine whether this was a legitimate certificate request or an unauthorized write operation.
Review logs for preceding and subsequent authentication attempts.
Investigate the remote host for any suspicious activity.
Identify any subsequent Kerberos ticket usage, such as forging or relaying attacks.