ADCS -Certificate requested with SAN by non-admin to bypass HTTPS certificate validation
This query detects Identity Spoofing via Certificate Request, where a non-machine account (a human user) successfully requests a certificate containing a DNS Name in the Subject Alternative Name (SAN) field—an action typically reserved for servers—indicating the first step of a WSUS hijacking or server impersonation attack.
Microsoft Sentinel (KQL)
