win:security 4898
Certificate Services loaded a template.
- Log source
- Windows Security event log
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Advanced Audit Policy: Object Access > Audit Certification Services
- Audit category
- Object Access
- Audit subcategory
- Audit Certification Services
- Tier, host type
- Recommended
- Techniques
- 0
- Rules depending on it
- Sigma 2
Why this tier
NSA
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
Sigma 2
- ADCS Certificate Template Configuration Vulnerability by Orlinum , BlueDefenZer
- ADCS Certificate Template Configuration Vulnerability with Risky EKU by Orlinum , BlueDefenZer
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| NSA: Recommended Windows events to forwardEvent Forwarding Guidance (RecommendedEvents.csv) | Names this event | Certificate Services: Certificate Services Loaded Template |
| Microsoft: Events to monitor with potential criticalityAppendix L: Events to Monitor (Windows Server AD DS best practices) | Names this event | potential criticality Low: Certificate Services loaded a template. |