Hunt for https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26

HuntCertighost.kql

let DomainControllersFileEvents = DeviceFileEvents
    | where FileName == "ntds.dit" and FolderPath has @"\Windows\NTDS\"
    | summarize by DeviceId;
let DomainControllersExposureNodes = ExposureGraphNodes
    | where Categories has "device"
    | where NodeProperties has "DomainController"
    | mv-expand EntityIds to typeof(dynamic)
    | extend DeviceId = tostring(EntityIds.id) 
    | summarize by DeviceId;
let DomainControllers = union DomainControllersExposureNodes, DomainControllersFileEvents
    | summarize by DeviceId;
let DomainControllerNetworkInfo = DeviceNetworkInfo
    | where DeviceId in (DomainControllers)
    | where NetworkAdapterStatus == @"Up"
    | mv-expand todynamic(IPAddresses) to typeof(dynamic)
    | where ConnectedNetworks has "Domain"
    | extend IPAddress = tostring(IPAddresses.IPAddress)
    | summarize by IPAddress;
let CAServersExposureNodes =    ExposureGraphNodes
    | where Categories has "device"
    | where NodeProperties has "ActiveDirectoryCertificateServicesServer"
    | mv-expand EntityIds to typeof(dynamic)
    | where EntityIds.type == 'SenseDeviceId'
    | extend DeviceId = tostring(EntityIds.id) 
    | summarize by DeviceId;
let CAServersByProcess = DeviceProcessEvents
    | where FileName =~ "certsrv.exe"
    | summarize by DeviceId;
let CAServers = union CAServersExposureNodes, CAServersByProcess
    | summarize by DeviceId;
DeviceNetworkEvents
| where DeviceId in (CAServers)
| where ActionType == "ConnectionSuccess"
| where RemoteIPType != "Loopback"
| where RemotePort in (389, 445, 636)
// Exclude known Domain Controllers
| where RemoteIP !in (DomainControllerNetworkInfo)
| summarize
    RemotePorts=make_set(RemotePort),
    FirstSeen=min(Timestamp),
    LastSeen=max(Timestamp)
    by
    DeviceName,
    InitiatingProcessFileName,
    RemoteIP,
    RemotePort,
    RemoteUrl
| extend Description = iff(
                           RemotePorts has_any (389, 636),
                           "High indication of CVE-2026-54121 abuse, RemotePort is LDAP related",
                           iff(
    array_length(RemotePorts) > 1,
    "High indication of CVE-2026-54121 abuse, connections to multiple ports",
    "Low likelyhood of CVE-2026-54121 abuse, just 445 traffic"
)
                       )
| join kind=leftouter (DeviceInfo | where isnotempty(DeviceName) | summarize by DeviceId, DeviceName) on $left.RemoteUrl == $right.DeviceName
| where DeviceId !in (DomainControllers)