AD CS Certificate Template with Enrollee-Supplied Subject Flag
This rule detects the creation or update of Active Directory Certificate Services (AD CS) certificate templates that include the 'CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT' flag. This flag allows a user to specify the subject name in a certificate request, which can be abused for privilege escalation or credential access, particularly in scenarios involving misconfigured AD CS environments as described in the 'Certified Pre-Owned' research.
Sigma
