Skip over CAs that can't be resolved to SIDs during collection

SpecterOps · Mar 13, 2024 · a8578c3 · a8578c3
1 parent cc52d72
commit a8578c3
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/src/Runtime/ObjectProcessors.cs b/src/Runtime/ObjectProcessors.cs
@@ -638,6 +638,13 @@ private async Task<EnterpriseCA> ProcessEnterpriseCA(ISearchResultEntry entry, R
                 {
                     ret.HostingComputer = await _context.LDAPUtils.ResolveHostToSid(dnsHostName, resolvedSearchResult.Domain);
 
+                    // If ResolveHostToSid does not return a valid SID, we don't want to process this CA
+                    if (ret.HostingComputer == null || !ret.HostingComputer.StartsWith("S-1-"))
+                    {
+                        _log.LogWarning("CA could not be resolved to a SID, skipping.", dnsHostName, resolvedSearchResult.Domain);
+                        return null;
+                    }
+
                     CARegistryData cARegistryData = new()
                     {
                         IsUserSpecifiesSanEnabled = _certAbuseProcessor.IsUserSpecifiesSanEnabled(dnsHostName, caName),