certlog

$ target-query <path/to/target> -f certlog

Details

Module	dissect.target.plugins.os.windows.certlog.CertLogPlugin
Output	records

Module documentation

Return all available data stored in CertLog databases.

Certificate Authority databases are databases related to the Active Directory Certificate Services (AD CS) feature.

References:

• https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-csra/5f06c74c-1a29-4fdf-b8dd-ae3300d1b90d

• https://assets.crowdstrike.com/is/content/crowdstrikeinc/investigating-active-directory-certificate-abusepdf

• https://learn.microsoft.com/en-gb/troubleshoot/windows-server/certificates-and-public-key-infrastructure-pki/move-certificate-server-database-log-files

Function documentation

This is a namespace plugin. This means that by running this plugin, it will automatically run all other plugins under this namespace:

• certlog.certificate_extensions

• certlog.certificates

• certlog.crls

• certlog.request_attributes

• certlog.requests