AD CS ESC1\ESC6 Certificate Subject Alternative Name Mismatch
Detects Active Directory Certificate Services (AD CS) certificate requests where the Subject Alternative Name (SAN) contains a User Principal Name (UPN) that does not match the requester's identity. This pattern indicates potential exploitation of ESC1 or ESC6 certificate template misconfigurations, allowing an attacker to request certificates for arbitrary identities.
Cortex XDR
