AD CS configuration was changed.
AD CS configuration changes can introduce ESC vulnerabilities. Attacker with CA admin rights may modify templates to make them vulnerable or enable web enrollment.
Alert on every occurrence. Verify with change management — AD CS config changes should be rare and documented.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName | Tactic | Technique |
|---|---|
| Persistence | Steal or Forge Authentication Certificates (T1649) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4890 // The settings for Certificate Services changed
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=4890
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# The settings for Certificate Services changed — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`The settings for Certificate Services changed. AD CS configuration was changed.
Event 4890 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Certificate Services' subcategory (Success and/or Failure).
Event 4890 is associated with: Steal or Forge Authentication Certificates (T1649).
Alert on every occurrence. Verify with change management — AD CS config changes should be rare and documented.