win:security 4887
Certificate Services approved a certificate request and issued a certificate.
- Log source
- Windows Security event log
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Advanced Audit Policy: Object Access > Audit Certification Services
- Audit category
- Object Access
- Audit subcategory
- Audit Certification Services
- Tier, host type
- Recommended
- Techniques
- 0
- Rules depending on it
- Splunk 3, Sigma 1, Elastic 1
Why this tier
NSA
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
Splunk 3
Sigma 1
- ADCS - Certighost Certificate Issued via CDC Chase (CVE-2026-54121) by Swachchhanda Shrawan Poudel (Nextron Systems)
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| NSA: Recommended Windows events to forwardEvent Forwarding Guidance (RecommendedEvents.csv) | Names this event | Certificate Services: Certificate Services approved request |
| Microsoft: Events to monitor with potential criticalityAppendix L: Events to Monitor (Windows Server AD DS best practices) | Names this event | potential criticality Low: Certificate Services approved a certificate request and issued a certificate. |