Certighost Vulnerability Lets Low‑Privileged AD Users Impersonate Domain Controllers and Extract krbtgt
What Happened — Researchers released a working exploit (codenamed Certighost) that enables a low‑privileged Active Directory (AD) account to obtain a certificate for a Domain Controller (DC) and authenticate as that machine. The forged DC credential can be used with DCSync to pull the krbtgt secret, effectively compromising the Kerberos trust anchor.
Why It Matters for Compliance & Audit Readiness
- This scenario directly tests the effectiveness of SOC 2 CC6.1 (Logical Access) controls that restrict privileged AD operations to authorized accounts.
- Continuous evidence of certificate‑issuance policies and privileged‑access monitoring is essential to demonstrate due diligence during an audit.
- Verisq’s SOC2 Access Controls capability can automatically collect and correlate AD certificate activity, providing a defensible audit trail.
Who Is Affected — Enterprises that rely on on‑premises or hybrid Active Directory for identity management (e.g., technology, financial services, SaaS providers).
Recommended Actions — Review and tighten AD certificate enrollment permissions; enforce least‑privilege for account creation; enable monitoring for anomalous DC‑issued certificates and DCSync activity; map these checks to SOC 2 CC6.1 and CC6.2 controls; retain logs as audit evidence. Source: The Hacker News
Technical Notes — The exploit leverages a flaw in the AD Certificate Services enrollment process to forge a DC‑authenticating certificate. No CVE ID has been assigned yet; the vulnerability enables credential theft via Kerberos replication (DCSync). Source: The Hacker News