CVE-2026-20929, a vulnerability with a CVSS of 7.5 that was patched in the January 2026 Patch Tuesday update, enables attackers to exploit Kerberos authentication relay through DNS CNAME record abuse. This blog focuses on detecting one particularly impactful attack vector: relaying authentication to Active Directory Certificate Services (AD CS) to enroll certificates for user accounts, as detailed in recent research.
CrowdStrike has developed a correlation-based detection that identifies this specific attack pattern by monitoring for anomalous certificate-based authentication combined with unusual AD CS service access within a short time window.
CVE-2026-20929 represents a sophisticated attack vector that exploits the interaction between DNS CNAME records and Kerberos Service Principal Name (SPN) resolution. While this vulnerability can be exploited against various services, this blog focuses on one particularly dangerous attack vector: relaying Kerberos authentication to AD CS servers to enroll certificates for user accounts, providing persistent access that can last months or years.
Understanding CVE-2026-20929 requires context from prior Kerberos relay research:
Kerberos Relay Fundamentals: In 2021, a security researcher demonstrated that Kerberos authentication can be relayed if an attacker can control the SPN used by a client. This research explored multiple techniques for influencing SPN selection across various protocols, challenging the assumption that Kerberos was inherently relay-proof.
DNS-Based Kerberos Relay: In 2022, a security researcher demonstrated practical Kerberos relay techniques using mitm6 to relay DNS authentication to AD CS endpoints. His work showed how DHCPv6 spoofing combined with DNS manipulation could enable Kerberos relay attacks and resulted in the krbrelayx tool.
AD CS Attack Vectors: The SpecterOps research team's "Certified Pre-Owned" work documented AD CS exploitation techniques, including ESC8 (relay to AD CS HTTP endpoints), establishing the foundation for understanding certificate-based attacks in Active Directory.
Before diving into the Kerberos variant, it's important to understand the foundational attack: ESC8, documented in the SpecterOps "Certified Pre-Owned" research.
AD CS provides a web-based enrollment interface (accessible via the /certsrv endpoint) that allows users and computers to request certificates through a browser. This "Certification Authority Web Enrollment" component accepts both NTLM and Kerberos authentication. The ESC8 attack exploits this interface through NTLM relay:
AD CS web enrollment represents a particularly attractive target for Kerberos relay attacks for several reasons:
CVE-2026-20929 exploits how Kerberos handles Service Principal Names during the DNS resolution process that precedes authentication.
Before a client can authenticate to a service, it must resolve the service hostname to an IP address via DNS. Attackers can manipulate this resolution step by crafting DNS responses that contain both:
Figure 1. Flow of the CVE-2026-20929 vulnerability
This combined DNS response causes the client to automatically request a Kerberos service ticket for the attacker-specified hostname while connecting to the attacker-controlled IP address. The client is unaware that the SPN in its Kerberos ticket doesn't match the actual service it's connecting to.
CrowdStrike's detection leverages the CrowdStrike Falcon® platform's unique identity protection capabilities, which provide deep visibility into authentication traffic across the enterprise. Unlike traditional security solutions that rely on endpoint or network logs alone, CrowdStrike Falcon® Next-Gen Identity Security performs real-time inspection of authentication protocols including Kerberos, NTLM, and LDAP traffic.
Falcon Next-Gen Identity Security provides comprehensive authentication traffic visibility through:
This multi-layered approach enables both automated detection through correlation logic and proactive threat hunting through raw authentication data analysis.
This detection uses behavioral correlation to identify the complete attack chain rather than relying on individual indicators. This approach provides high-confidence detection while minimizing false positives by focusing on the temporal relationship between authentication relay and certificate usage.
This detection identifies unusual patterns in certificate authentication like:
A user authenticates with a certificate from an endpoint or IP address they haven't used for certificate authentication before.
Figure 2. Detection fired for “Anomalous certificate-based authentication”
This detection monitors for abnormal service access patterns like:
A user unexpectedly requests a Kerberos service ticket to a target.
Figure 3. Detection fired for “Unusual service access to an endpoint”
The alert triggers when both detections occur within a close time and target an AD CS service:
Alert conditions:
To implement this detection capability, customers must manually enable the CRT through the Falcon Next-Gen SIEM platform by navigating to NGS → Monitor and investigate → Rules → Templates and searching for the relevant CRT: “CrowdStrike - Identity - Abnormal Certificate Authentication (CVE-2026-20929).”
The Falcon platform provides comprehensive protection capabilities that directly address these mitigation strategies.
CrowdStrike Falcon® Exposure Management delivers critical visibility for patch management initiatives, enabling organizations to rapidly identify vulnerable systems and prioritize remediation efforts based on actual risk exposure. This capability is essential for implementing the first mitigation strategy effectively, allowing critical patches like the CVE-2026-20929 fix to be deployed systematically across the enterprise.
Falcon Next-Gen Identity Security provides insights into Active Directory environment configurations, surfacing critical security risks that could enable Kerberos relay attacks. It continuously monitors and assesses AD security posture.
Beyond configuration assessment, Falcon Next-Gen Identity Security delivers account activity monitoring, including detailed Kerberos authentication tracking and behavioral analysis.
It provides multiple detections that can identify suspicious authentication patterns and potential relay attack attempts in real time.
CVE-2026-20929 represents a significant threat to organizations by enabling attackers to relay Kerberos authentication through DNS CNAME abuse. While this vulnerability can be exploited against multiple services, the AD CS relay vector is particularly dangerous as it enables attackers to obtain persistent access through certificate-based authentication, bypassing traditional password-based security controls. Understanding and detecting these attack patterns is crucial to maintaining security integrity in Active Directory environments.
The comprehensive Falcon platform provides multiple layers of protection:
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。
