Active Directory Certificate Services Denied Certificate Enrollment Request
Detects denied certificate enrollment requests by Active Directory Certificate Services. This can occur due to issues such as incorrect permissions on the certificate template or invalid signatures. While the rule itself doesn't directly detect the installation of a root certificate (T1553.004), a denied request could be an indicator of an adversary attempting to enroll a certificate for malicious purposes, potentially as a precursor to establishing trust for adversary-controlled infrastructure or for code signing. The denial of such a request could be a valuable alert for suspicious activity related to certificate services.
Sigma
