AD CS received a certificate request. RequesterName and CertificateTemplate are key.
ESC attacks (AD CS misconfigurations — ESC1-ESC8): attackers request certificates allowing domain privilege escalation. ESC1: request certificate with arbitrary SAN. ESC3: certificate request agent enrollment. Key: CertificateTemplate for sensitive templates (SmartCard, User, SubCA).
Alert: certificate requests from accounts not normally requesting certs for that template. Alert: SAN values not matching the requesting account. Correlate with Certipy, Certify tooling signatures.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName | Tactic | Technique |
|---|---|
| Credential Access | Steal or Forge Authentication Certificates (T1649) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
title: Suspicious AD CS Certificate Request
status: experimental
description: Certificate request to sensitive template — possible ESC attack
author: theadminstack.com
date: 2026/05/16
logsource:
product: windows
service: security
detection:
selection:
EventID: 4886
CertificateTemplate|contains:
- 'SubCA'
- 'DomainController'
- 'SmartcardLogon'
condition: selection
falsepositives:
- Legitimate certificate enrollment by IT
level: high
tags:
- attack.credential_access
- attack.t1649SecurityEvent
| where EventID == 4886 // Certificate Services received a certificate request
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=4886
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# Certificate Services received a certificate request — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`Certificate Services received a certificate request. AD CS received a certificate request. RequesterName and CertificateTemplate are key.
Event 4886 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Certificate Services' subcategory (Success and/or Failure).
Event 4886 is associated with: Steal or Forge Authentication Certificates (T1649).
Alert: certificate requests from accounts not normally requesting certs for that template. Alert: SAN values not matching the requesting account. Correlate with Certipy, Certify tooling signatures.