AD CS Bulk Certificate Request Monitoring
Monitors Active Directory Certificate Services (AD CS) for an unusual volume of certificate requests from a single requester within a short timeframe. This behavior is indicative of enumeration or exploitation activity by tools such as Certify or Certipy, which often perform rapid certificate requests to identify vulnerable templates or request certificates for unauthorized identities.
Cortex XDR
