Cpe:2.3:a:microsoft:active_directory_certificate_services:*:*:*:*:*:*:*:*

This correlation identifies anomalous activity targeting Windows Certificate Services by aggregating multiple risk-based detections on a single system, signaling potential adversary efforts to forge or steal authentication certificates.