Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Fog – Certipy AD CS Enumeration Combined with Veeam Credential Harvesting

Fog Discovery Sentinel
MITRE ATT&CK
Steal or Forge Authentication Certificates
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (fog)
What This Detects
Fog affiliates run Certipy to enumerate/abuse vulnerable AD CS certificate templates alongside DonPAPI/Veeam-Get-Creds credential harvesting – a relatively distinctive combination centered on Veeam backup infrastructure and AD CS misconfigurations.
Query
let certipy = DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName has "certipy" or ProcessCommandLine has_any ("certipy find","certipy req -vulnerable")
| project DeviceName, CertipyTime = Timestamp, AccountName;
let credHarvest = DeviceProcessEvents
| where Timestamp > ago(1d)
| where ProcessCommandLine has_any ("DonPAPI","Veeam-Get-Creds","veeam-get-creds")
| project DeviceName, HarvestTime = Timestamp;
certipy
| join kind=inner credHarvest on DeviceName
| where HarvestTime - CertipyTime between (-4h .. 4h)

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.