Possible ADCS Certificate Template Configuration Vulnerability (via security)

title: Possible ADCS Certificate Template Configuration Vulnerability (via security)
id: bd881973-49f8-54c4-99fb-6e75d5318c8a
status: stable
description: This rule detects certificate creation with template allowing risk permission subject
references:
    - https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf
author: Huntrule Team
date: 2026-03-30
tags:
    - attack.privilege-escalation
    - attack.credential-access
    - attack.t1649
logsource:
    product: windows
    service: security
    definition: Certificate services loaded a template would trigger event ID 4898 and certificate Services template was updated would trigger event ID 4899. A risk permission seems to be coming if template contain specific flag.
detection:
    selection1:
        EventID: 4898
        TemplateContent|contains: 'CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT'
    selection2:
        EventID: 4899
        NewTemplateContent|contains: 'CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT'
    condition: selection1 or selection2
falsepositives:
    - Unknown
level: low