AD CS denied a certificate request.
Denied certificate requests may indicate access controls are working (good) or an attacker probing available templates.
Alert: repeated denials for sensitive templates from same account — template enumeration.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4888 // Certificate Services denied a certificate request
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=4888
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# Certificate Services denied a certificate request — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`Certificate Services denied a certificate request. AD CS denied a certificate request.
Event 4888 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Certificate Services' subcategory (Success and/or Failure).
Alert: repeated denials for sensitive templates from same account — template enumeration.