Audit Certification Services
Some detection rules require monitoring Active Directory Certificate Services (AD CS) operations to identify suspicious certificate requests and issuance. This audit policy applies to servers that host the Certification Authority role. Both the Windows audit policy and the certification authority (CA) audit filter must be configured to generate Certificate Services events in the Windows Security log.
Caution: Certificate request auditing can increase Security log volume on busy certification authorities. Validate log retention and forwarding capacity before broad deployment.
To enable Audit Certification Services on enterprise certification authorities via Group Policy, administrators must enable the Audit Certification Services policy. Follow these steps to configure the policy via Advanced Audit Policy Configuration:
Computer Configuration >
Policies >
Windows Settings >
Security Settings >
Advanced Audit Policy Configuration >
Audit Policies >
Object Access >
Audit Certification Services (Success,Failure)
To enable this policy on a local certification authority, run the following command in an elevated command prompt:
auditpol.exe /set /subcategory:"Certification Services" /success:enable /failure:enable
The Windows audit policy does not generate certificate request events unless the CA audit filter is also configured. On each certification authority, open the Certification Authority snap-in (certsrv.msc), right-click the CA name, select Properties, select the Auditing tab, and enable Issue and manage certificate requests.
Alternatively, run the following commands from an elevated PowerShell session. The +4 value enables this audit category without clearing other categories from the existing CA audit filter:
certutil.exe -setreg CA\AuditFilter +4
Restart-Service certsvc
Restarting Certificate Services briefly interrupts certificate enrollment. Apply the change during an approved maintenance window.
Collect the Windows Security log from each certification authority. Detection rules that inspect certificate request attributes require the complete multiline winlog.event_data.Attributes value. Dropped, truncated, or rewritten attributes create a visibility gap.
When this audit policy and the Issue and manage certificate requests CA audit filter are enabled, the following request-lifecycle event IDs may be generated:
- 4886: Certificate Services received a certificate request.
- 4887: Certificate Services approved a certificate request and issued a certificate.
- 4888: Certificate Services denied a certificate request.
- 4889: Certificate Services set the status of a certificate request to pending.
Use the following GitHub search to identify rules that use the events listed: