ESC1 AD CS certificate issued with requester-supplied SAN differing from request
Detects Active Directory Certificate Services (AD CS) certificate issuance events (Event ID 4887) where the user requesting the certificate differs from the Subject Alternative Name (SAN) identity supplied in the request. This behavior is indicative of ESC1-style AD CS privilege escalation abuse, where a user requests a certificate on behalf of another privileged user.
Microsoft Sentinel (KQL)
