Certutil with -ADCA Flag
Detects the execution of certutil.exe with command-line flag that can be used to interact with Active Directory Certificate Services, potentially for malicious purposes such as certificate theft or abuse.
Microsoft Sentinel (KQL)
