Red team sneakiness: Splunking for AD certificate abuse

This report describes a red-team abuse of Active Directory Certificate Services (AD CS) and the authors' process for hunting related Windows System EventCode 39 events; they developed two high-fidelity Splunk detections that (1) flag mismatches between the certificate CN and the AccountName and (2) flag CNs that appear to be machine names ending with $. The write-up explains CN extraction from the Subject field, provides example Splunk queries, and recommends scoping and tuning before deployment.