Windows AD CS Denied Certificate Enrollment Requests (Event ID 53)
Alerts on CA-side denied certificate enrollment attempts in Windows via Microsoft-Windows-CertificationAuthority Event ID 53.
- Product
- windows
- Service
- system
- Author
- @SerkinValery (SigmaHQ), DRL 1.1
- Published
- 2024-03-07
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows events from Microsoft-Windows-CertificationAuthority where certificate enrollment requests are denied (Event ID 53). Denied requests can indicate attempts to enroll using misconfigured or unauthorized certificate template permissions or invalid request data. Detection relies on system telemetry from the Certificate Authority provider capturing Event ID 53.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd299871(v=ws.10)
- gradenegger.euhttps://www.gradenegger.eu/en/details-of-the-event-with-id-53-of-the-source-microsoft-windows-certificationauthority/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/microsoft_windows_certification_authority/win_system_adcs_enrollment_request_denied.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows AD CS Denied Certificate Enrollment Requests (Event ID 53)
id: c4390139-f23f-45b1-bab8-11b8f8c270f8
status: test
description: This rule flags Windows events from Microsoft-Windows-CertificationAuthority where certificate enrollment requests are denied (Event ID 53). Denied requests can indicate attempts to enroll using misconfigured or unauthorized certificate template permissions or invalid request data. Detection relies on system telemetry from the Certificate Authority provider capturing Event ID 53.
references:
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd299871(v=ws.10)
- https://www.gradenegger.eu/en/details-of-the-event-with-id-53-of-the-source-microsoft-windows-certificationauthority/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/microsoft_windows_certification_authority/win_system_adcs_enrollment_request_denied.yml
author: "@SerkinValery, Huntrule Team"
date: 2024-03-07
tags:
- attack.credential-access
- attack.defense-impairment
- attack.t1553.004
logsource:
product: windows
service: system
detection:
selection:
Provider_Name: Microsoft-Windows-CertificationAuthority
EventID: 53
condition: selection
falsepositives:
- Unknown
level: low
license: DRL-1.1
related:
- id: 994bfd6d-0a2e-481e-a861-934069fcf5f5
type: derived