Skip to content
Sign In
Telemetry

win:security 4876

Certificate Services backup started.

Log source
Windows Security event log
Host type
Windows (workstation, member server, domain controller)
How to enable
Advanced Audit Policy: Object Access > Audit Certification Services
Audit category
Object Access
Audit subcategory
Audit Certification Services
Tier, host type
Listed
Techniques
0
Rules depending on it
Splunk 1

Why this tier

Techniques it helps detect

No ATT&CK analytic names this event. Its standing comes from the standards and rules below.

Rules that depend on it

Splunk 1

Standards and guidance naming it

RequirementRelationBasis
Microsoft: Events to monitor with potential criticalityAppendix L: Events to Monitor (Windows Server AD DS best practices)Names this eventpotential criticality Low: Certificate Services backup started.

Dataset version 0.5.3, built 2026-11-08, from public sources only. Vendor rule names, requirement text and ATT&CK content are reproduced as published; the links between them are the authors' analysis. See the references for each source, its version and its license.