Windows Active Directory Certificate Services Denied Enrollment Requests (Event ID 53)

title: Windows Active Directory Certificate Services Denied Enrollment Requests (Event ID 53)
id: c4390139-f23f-45b1-bab8-11b8f8c270f8
status: test
description: This rule flags denied certificate enrollment requests from Active Directory Certificate Services when the Certification Authority emits Event ID 53. Attackers may trigger these denials during probing for misconfigurations, attempting unauthorized enrollment, or causing failed enrollment flows tied to credential access techniques. The detection relies on Windows System logs containing Provider_Name Microsoft-Windows-CertificationAuthority with EventID 53.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd299871(v=ws.10)
  - https://www.gradenegger.eu/en/details-of-the-event-with-id-53-of-the-source-microsoft-windows-certificationauthority/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/microsoft_windows_certification_authority/win_system_adcs_enrollment_request_denied.yml
author: "@SerkinValery, Huntrule Team"
date: 2024-03-07
tags:
  - attack.credential-access
  - attack.defense-impairment
  - attack.t1553.004
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Microsoft-Windows-CertificationAuthority
    EventID: 53
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 994bfd6d-0a2e-481e-a861-934069fcf5f5
    type: derived