ESC8 NTLM relay: DC machine account auth to AD CS /certsrv from non-DC device
Detects machine account NTLM logons to an Active Directory Certificate Services (AD CS) Web Enrollment server where the source device differs from the account's own host (indicative of NTLM coercion like PetitPotam), followed within 10 minutes by certificate enrollment requests (/certsrv/) from the same source host.
Microsoft Sentinel (KQL)
