win:security 4896
One or more rows have been deleted from the certificate database.
- Log source
- Windows Security event log
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Advanced Audit Policy: Object Access > Audit Certification Services
- Audit category
- Object Access
- Audit subcategory
- Audit Certification Services
- Tier, host type
- Recommended
- Techniques
- 0
- Rules depending on it
- none
Why this tier
Microsoft Appendix L Medium; NSA
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
No vendor rule names this event or source directly.
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| NSA: Recommended Windows events to forwardEvent Forwarding Guidance (RecommendedEvents.csv) | Names this event | Certificate Services: Entries Removed from Certificate Database |
| Microsoft: Events to monitor with potential criticalityAppendix L: Events to Monitor (Windows Server AD DS best practices) | Names this event | potential criticality Medium: One or more rows have been deleted from the certificate database. |