Certipy
Certipy is an open-source tool used for Active Directory discovery and abuse, particularly around Active Directory Certificate Services (AD CS) and collection of Active Directory-related credential and certificate data. In the provided reporting, Cisco Talos observed the China-linked threat actor UAT-8837 deploying Certipy during post-compromise activity against critical infrastructure organizations in North America since at least 2025. The actor used it alongside tools such as Rubeus, SharpHound, Impacket, GoExec, Earthworm, and DWAgent after gaining initial access via exploitation of vulnerable servers or use of compromised credentials, including in activity involving Sitecore vulnerability CVE-2025-53690. Talos specifically described Certipy as being used for AD discovery and abuse and for enumerating Active Directory users, groups, SPNs, service accounts, and domain relationships, as well as collecting Active Directory-related credential and certificate data. The reporting does not provide Certipy-specific indicators of compromise, but places its use within broader UAT-8837 intrusions involving credential harvesting, Kerberos abuse, remote execution, tunneling, and Active Directory reconnaissance.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Techniques & procedures
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Persistence
4 techniques
Persistence
In this case, you should try SChannel authentication and logging into LDAP. certipy auth -pfx adm.pfx -ldap-shell | You can use a certificate for WinRM authentication... evil-winrm -S -k ./key.pem -c ./cert.crt -i 10.10.11.152
Add Shadow Credentials Same as before, we’ll create shadow credentials using Certipy: certipy-ad shadow auto ... Adding shadow creds to james account | Modify the UPN ... we’ll set it to a DC machine account — in this case, LAB-DC.LAB.LOCAL for Schannel certificate-based authentication. certipy-ad account update ... -upn 'lab-dc$@lab.local'
Privilege Escalation
4 techniques
Privilege Escalation
In this case, you should try SChannel authentication and logging into LDAP. certipy auth -pfx adm.pfx -ldap-shell | You can use a certificate for WinRM authentication... evil-winrm -S -k ./key.pem -c ./cert.crt -i 10.10.11.152
Add Shadow Credentials Same as before, we’ll create shadow credentials using Certipy: certipy-ad shadow auto ... Adding shadow creds to james account | Modify the UPN ... we’ll set it to a DC machine account — in this case, LAB-DC.LAB.LOCAL for Schannel certificate-based authentication. certipy-ad account update ... -upn 'lab-dc$@lab.local'
Stealth
2 techniques
Stealth
Defense Impairment
1 technique
Defense Impairment
Credential Access
6 techniques
Credential Access
This method relies on the ability to obtain the user’s NTLM hash using the PKINIT mechanism... Got NT hash for 'administrator@contoso.com'
If the certificate template lacks the required security extension (objectSid), and we control a user account, we can manipulate its attributes to request a certificate that gets mapped to a different identity, like a DA.
So, this is the most common use case for a certificate with Client Authentication EKU. If you can authenticate with the certificate, then you are able to get a TGT ticket.
Through these techniques, threat actors abuse certificate templates which don’t require manager approval and include enrollment rights for low privileged users / groups.
Shadow Credentials let us generate our own key pair and inject it into the msDS-KeyCredentialLink attribute of the target account. This gives us a way to authenticate as the user james without changing their actual password.
This method relies on the ability to obtain the user’s NTLM hash using the PKINIT mechanism. Rubeus asktgt /getcredential... Trying to retrieve NT hash... Got NT hash | Attacks on AD CS are becoming more popular by the day... You are more likely to get a certificate during exploitation... We may have stolen it from somewhere, such as a network share.
Discovery
3 techniques
Discovery
“SharpHound & Certipy: Used for deep reconnaissance of Active Directory environments.”
The first step for threat actors after initial access is usually enumeration. Threat actors need to enumerate the certificate templates available for their compromised user as well as other AD attributes, in order to determine whether any of the ESC techniques is viable.
Lateral Movement
3 techniques
Lateral Movement
Use the auth command to authenticate as administrator and grab the NT hash: certipy auth -pfx administrator.pfx -domain lab.local -dc-ip 10.129.228.236 ... Retrieved the Administrator NT hash
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An AD CS enumeration/abuse tool used to collect certificate-related data and facilitate credential access via certificate services misconfigurations.
A tool used for Active Directory discovery and abuse, particularly in certificate services contexts.
Tool for enumerating and abusing AD CS misconfigurations to escalate privileges and obtain persistence via certificate-based attacks.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.