Detect Certipy by watching for Active Directory Certificate Services abuse patterns, including certificate template enumeration, misconfiguration discovery, and suspicious certificate request activity. Review directory, certificate authority, and endpoint telemetry for unexpected AD CS interactions. Tighten template permissions, audit enrolment rights, and alert on unusual certificate lifecycle operations.
What Certipy activity looks like in telemetry
Certipy detection starts with understanding what the tool is usually trying to do in Active Directory Certificate Services, not just whether a single command line appears. The useful signals are repeated directory queries, template enumeration, certificate authority discovery, enrolment checks, and requests that do not fit normal helpdesk or PKI administration patterns.
Those behaviours often show up across multiple layers. Directory logs may show unusual object reads or policy lookups, certificate authority logs may show unexpected template or request activity, and endpoint telemetry may show a short burst of discovery and certificate operations from a host that does not normally manage PKI. The pattern matters more than any one event.
For teams already standardising on broader monitoring guidance, NIST Cybersecurity Framework 2.0 is useful for structuring that detection work across identify, protect and detect functions, while MITRE ATT&CK Enterprise Matrix helps map certificate abuse activity to credential access and privilege escalation techniques.
Where defenders should focus their detections
High-value detections usually sit at three choke points: AD directory activity, the certificate authority, and the endpoint that launched the action. If a workstation or server that is not part of PKI operations suddenly enumerates certificate templates, probes enrolment rights, or submits unusual requests, that is often more useful than waiting for a confirmed malicious certificate to appear.
Template permissions and enrolment rights are especially important because attackers often look for weakly governed templates rather than attacking the CA directly. Any template that allows broad enrolment, exposes risky subject name handling, or grants unexpected EKU combinations deserves tighter monitoring and a clear owner.
Practitioners that want a broader hardening baseline can use the Active Directory and Entra ID Hardening Guide as a practical companion for tightening privileged paths, reviewing service accounts, and reducing the likelihood that certificate abuse leads to wider directory compromise.
How to reduce false positives without missing real abuse
Legitimate PKI administration can look noisy, so detections need context. Build allowlists around known CA operators, scheduled certificate management jobs, approved admin workstations, and known change windows. Then alert on deviations such as a new source host, a new user context, a sudden increase in template discovery, or certificate requests that target privileged or long-lived access paths.
Correlating request telemetry with directory and endpoint data is the fastest way to separate normal administration from abuse. A single request may be benign, but a sequence that includes template enumeration, permission discovery, and immediate enrolment activity from the same source is much harder to explain as routine use.
Risk and Threat Considerations
Certipy is useful to defenders because the same workflow that identifies weak AD CS configurations can also be used to turn those weaknesses into privilege escalation. The risk is highest where certificate templates are overexposed, enrolment rights are broad, or certificate issuance is not being correlated with the identity that initiated it.
Failure mechanism: An attacker enumerates templates, finds a misconfiguration that supports unintended enrolment or subject control, and then converts that path into a certificate that can authenticate as a more privileged identity.
Impact: The result can be durable access that is harder to spot than password theft, especially if the certificate is treated as legitimate infrastructure activity and not tied back to the original discovery sequence.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM-01 — Continuous Monitoring | Certipy detection depends on continuous monitoring of directory, CA and endpoint activity. |
| Recommendation — Correlate AD CS activity across logs to detect unusual certificate abuse patterns. | ||
| MITRE ATT&CK | T1552 — Unsecured Credentials | Certipy-style abuse often pivots through stolen or misused certificate material and related access paths. |
| Recommendation — Map certificate abuse telemetry to credential-access techniques and hunt for privilege escalation. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Detecting AD CS abuse requires review and correlation of audit records from multiple sources. |
| AC-6 — Least Privilege | Template permissions and enrolment rights are the control boundary Certipy commonly targets. | |
| Recommendation — Review CA, directory and endpoint audit records for abnormal certificate operations. Restrict certificate template and enrolment rights to the minimum set of approved operators. | ||
Practitioner Guidance
What to verify: Confirm that your telemetry can connect directory reads, CA activity, and endpoint execution back to the same user and source host. If those events live in separate tools with no correlation logic, Certipy-style activity will often look fragmented and low confidence.
Decision rule: If a non-CA host triggers template enumeration followed by enrolment or request activity, treat it as a priority investigation even when the request itself succeeds. Success is often the signal that the environment is permissive enough to matter.
What good looks like: You can distinguish approved PKI administration from abuse by source, time, role, and certificate purpose, and you can quickly answer which template, which account, and which asset path were involved.
Practitioner takeaway: The strongest Certipy detections are sequence-based, not event-based, because the abuse path usually becomes obvious only when directory, CA, and endpoint telemetry are viewed together.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org