4887 Security log · Certificate Services medium severity medium volume

Windows Event ID 4887 — Certificate Services approved a certificate request and issued a certificate

A certificate was issued by AD CS. RequesterName, CertificateTemplate, and SerialNumber are key.

Why event 4887 matters

Certificate issuance following an ESC attack. A certificate issued via ESC1 can be used with PKINIT for domain privilege escalation. Any certificate issued to unexpected accounts or with unusual templates warrants investigation.

How to detect it

Alert: certificate issued for SubCA, DomainController, or other privileged templates to non-admin accounts. Correlate with 4886 (request) — request+approval chain reveals the full ESC attack.

Log source
Security
Advanced Audit Policy — enable the 'Certificate Services' subcategory (Success and/or Failure).
Fields to pivot on
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

MITRE ATT&CK mapping

Tactic Technique
Credential Access Steal or Forge Authentication Certificates (T1649)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL
SecurityEvent
| where EventID == 4887   // Certificate Services approved a certificate request and issued a certificate
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=4887
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Certificate Services approved a certificate request and issued a certificate — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
Hunt event 4887 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related Certificate Services events

4886 Certificate Services received a certificate request 4888 Certificate Services denied a certificate request 4890 The settings for Certificate Services changed 4896 One or more rows have been deleted from the certificate database

Frequently asked questions

What is Windows Event ID 4887?

Certificate Services approved a certificate request and issued a certificate. A certificate was issued by AD CS. RequesterName, CertificateTemplate, and SerialNumber are key.

Which log records event 4887?

Event 4887 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Certificate Services' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 4887?

Event 4887 is associated with: Steal or Forge Authentication Certificates (T1649).

How do you detect activity around event 4887?

Alert: certificate issued for SubCA, DomainController, or other privileged templates to non-admin accounts. Correlate with 4886 (request) — request+approval chain reveals the full ESC attack.