Suspicious ADCS Certificate Request - Possible ESC Attack
Detects certificate requests containing indicators often associated with Active Directory Certificate Services (AD CS) abuse, such as requests involving Subject Alternative Name (SAN) or smart card authentication attributes, which may indicate attempts to escalate privileges or move laterally via certificate forgery.
Microsoft Sentinel (KQL)
