Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Fog – Certipy AD CS Enumeration Combined with Veeam Credential Harvesting

Fog Discovery Sentinel
MITRE ATT&CK
Steal or Forge Authentication Certificates
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (fog)
What This Detects
Fog affiliates run Certipy to enumerate/abuse vulnerable AD CS certificate templates alongside DonPAPI/Veeam-Get-Creds credential harvesting – a relatively distinctive combination centered on Veeam backup infrastructure and AD CS misconfigurations.
Query
let certipy = DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName has "certipy" or ProcessCommandLine has_any ("certipy find","certipy req -vulnerable")
| project DeviceName, CertipyTime = Timestamp, AccountName;
let credHarvest = DeviceProcessEvents
| where Timestamp > ago(1d)
| where ProcessCommandLine has_any ("DonPAPI","Veeam-Get-Creds","veeam-get-creds")
| project DeviceName, HarvestTime = Timestamp;
certipy
| join kind=inner credHarvest on DeviceName
| where HarvestTime - CertipyTime between (-4h .. 4h)

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.