ADCS ESC1 Certificate Enrollment via Attacker-Supplied SAN
Detects ESC1-style ADCS certificate enrollment where a requester supplies an arbitrary SAN on a misconfigured template (CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT), enabling impersonation of any account. CISA's red team used this to certify a rogue machine account.
Microsoft Sentinel (KQL)
