Active Directory Certificate Services Denied Certificate Enrollment Request

Title: Active Directory Certificate Services Denied Certificate Enrollment Request
Status: test
Description:Detects denied requests by Active Directory Certificate Services. Example of these requests denial include issues with permissions on the certificate template or invalid signatures.
References:
  -https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd299871(v=ws.10)
  -https://www.gradenegger.eu/en/details-of-the-event-with-id-53-of-the-source-microsoft-windows-certificationauthority/
Author: @SerkinValery
Date: 2024-03-07
modified:None
Tags:

• -'attack.credential-access'
• -'attack.defense-impairment'
• -'attack.t1553.004'

Logsource:

• product: windows
• service: system

Detection:
  selection:
    Provider_Name: 'Microsoft-Windows-CertificationAuthority'
    EventID: '53'
  condition:selection
Falsepositives:
  -Unknown
Level: low