Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
MalwareUsed by 1 actor

Certipy

Certipy is an open-source tool used for Active Directory discovery and abuse, particularly around Active Directory Certificate Services (AD CS) and collection of Active Directory-related credential and certificate data. In the provided reporting, Cisco Talos observed the China-linked threat actor UAT-8837 deploying Certipy during post-compromise activity against critical infrastructure organizations in North America since at least 2025. The actor used it alongside tools such as Rubeus, SharpHound, Impacket, GoExec, Earthworm, and DWAgent after gaining initial access via exploitation of vulnerable servers or use of compromised credentials, including in activity involving Sitecore vulnerability CVE-2025-53690. Talos specifically described Certipy as being used for AD discovery and abuse and for enumerating Active Directory users, groups, SPNs, service accounts, and domain relationships, as well as collecting Active Directory-related credential and certificate data. The reporting does not provide Certipy-specific indicators of compromise, but places its use within broader UAT-8837 intrusions involving credential harvesting, Kerberos abuse, remote execution, tunneling, and Active Directory reconnaissance.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
UAT-8837

Certipy, a tool for Active Directory discovery and abuse

via the hacker newsthehackernews.com
MITRE ATT&CK

Techniques & procedures

18 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique
T1078Valid AccountsEvidence3

In this case, you should try SChannel authentication and logging into LDAP. certipy auth -pfx adm.pfx -ldap-shell | You can use a certificate for WinRM authentication... evil-winrm -S -k ./key.pem -c ./cert.crt -i 10.10.11.152

Persistence

4 techniques
T1078Valid AccountsEvidence3

In this case, you should try SChannel authentication and logging into LDAP. certipy auth -pfx adm.pfx -ldap-shell | You can use a certificate for WinRM authentication... evil-winrm -S -k ./key.pem -c ./cert.crt -i 10.10.11.152

T1098Account ManipulationEvidence3

Add Shadow Credentials Same as before, we’ll create shadow credentials using Certipy: certipy-ad shadow auto ... Adding shadow creds to james account | Modify the UPN ... we’ll set it to a DC machine account — in this case, LAB-DC.LAB.LOCAL for Schannel certificate-based authentication. certipy-ad account update ... -upn 'lab-dc$@lab.local'

T1136.002Domain AccountEvidence1

Creating a New Computer Account ... we can create a new computer account using Certipy’s built-in add_computer command ... We’ll create a machine account named rbcd-test$.

T1556Modify Authentication ProcessEvidence3

If the certificate template lacks the required security extension (objectSid), and we control a user account, we can manipulate its attributes to request a certificate that gets mapped to a different identity, like a DA.

Privilege Escalation

4 techniques
T1078Valid AccountsEvidence3

In this case, you should try SChannel authentication and logging into LDAP. certipy auth -pfx adm.pfx -ldap-shell | You can use a certificate for WinRM authentication... evil-winrm -S -k ./key.pem -c ./cert.crt -i 10.10.11.152

T1098Account ManipulationEvidence3

Add Shadow Credentials Same as before, we’ll create shadow credentials using Certipy: certipy-ad shadow auto ... Adding shadow creds to james account | Modify the UPN ... we’ll set it to a DC machine account — in this case, LAB-DC.LAB.LOCAL for Schannel certificate-based authentication. certipy-ad account update ... -upn 'lab-dc$@lab.local'

T1134Access Token ManipulationEvidence1

Since the UPN now matches that of the administrator, the certificate will be mapped to the administrator account during authentication, allowing us to impersonate them.

T1548Abuse Elevation Control MechanismEvidence2

In this scenario, our current domain user LAB.LOCAL\Black Wasp has Full Control, including both WriteOwner and WriteDacl rights over the template... the screenshot below shows that our user blwasp@lab.local has GenericAll rights over the ESC4 template.

Stealth

2 techniques
T1078Valid AccountsEvidence3

In this case, you should try SChannel authentication and logging into LDAP. certipy auth -pfx adm.pfx -ldap-shell | You can use a certificate for WinRM authentication... evil-winrm -S -k ./key.pem -c ./cert.crt -i 10.10.11.152

T1134Access Token ManipulationEvidence1

Since the UPN now matches that of the administrator, the certificate will be mapped to the administrator account during authentication, allowing us to impersonate them.

Defense Impairment

1 technique
T1556Modify Authentication ProcessEvidence3

If the certificate template lacks the required security extension (objectSid), and we control a user account, we can manipulate its attributes to request a certificate that gets mapped to a different identity, like a DA.

Credential Access

6 techniques
T1003OS Credential DumpingEvidence3

This method relies on the ability to obtain the user’s NTLM hash using the PKINIT mechanism... Got NT hash for 'administrator@contoso.com'

T1556Modify Authentication ProcessEvidence3

If the certificate template lacks the required security extension (objectSid), and we control a user account, we can manipulate its attributes to request a certificate that gets mapped to a different identity, like a DA.

T1558Steal or Forge Kerberos TicketsEvidence2

So, this is the most common use case for a certificate with Client Authentication EKU. If you can authenticate with the certificate, then you are able to get a TGT ticket.

T1606.001Web CookiesEvidence1

Through these techniques, threat actors abuse certificate templates which don’t require manager approval and include enrollment rights for low privileged users / groups.

T1606.002SAML TokensEvidence1

Shadow Credentials let us generate our own key pair and inject it into the msDS-KeyCredentialLink attribute of the target account. This gives us a way to authenticate as the user james without changing their actual password.

T1649Steal or Forge Authentication CertificatesEvidence13

This method relies on the ability to obtain the user’s NTLM hash using the PKINIT mechanism. Rubeus asktgt /getcredential... Trying to retrieve NT hash... Got NT hash | Attacks on AD CS are becoming more popular by the day... You are more likely to get a certificate during exploitation... We may have stolen it from somewhere, such as a network share.

Discovery

3 techniques
T1018Remote System DiscoveryEvidence2

“SharpHound & Certipy: Used for deep reconnaissance of Active Directory environments.”

T1046Network Service DiscoveryEvidence1

The first step for threat actors after initial access is usually enumeration. Threat actors need to enumerate the certificate templates available for their compromised user as well as other AD attributes, in order to determine whether any of the ESC techniques is viable.

T1482Domain Trust DiscoveryEvidence2

We start by finding certificate templates that are vulnerable to ESC9. For that, we can use Certipy and provide domain user credentials along with the domain controller IP.

Lateral Movement

3 techniques
T1550Use Alternate Authentication MaterialEvidence2

Use the auth command to authenticate as administrator and grab the NT hash: certipy auth -pfx administrator.pfx -domain lab.local -dc-ip 10.129.228.236 ... Retrieved the Administrator NT hash

T1550.002Pass the HashEvidence1

Now using this hash, authenticate to Machine with evil-winrm... evil-winrm -i 10.10.11.41 -u management_svc -H a091c1832bcdd4677c28b5a6a1295584

T1550.003Pass the TicketEvidence1

Set RBCD on the DC ... the command modifies the msDS-AllowedToActOnBehalfOfOtherIdentity attribute on the DC’s computer object to include our new machine account.

Collection

1 technique
T1560Archive Collected DataEvidence1

It leverages endpoint process and filesystem data to spot the creation of files with specific names or extensions associated with Certipy's information gathering and exfiltration activities.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping18

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.