Adcs

This correlation identifies anomalous activity targeting Windows Certificate Services by aggregating multiple risk-based detections on a single system, signaling potential adversary efforts to forge or steal authentication certificates.

This analytic detects the issuance of a suspicious certificate with a Subject Alternative Name (SAN) using Active Directory Certificate Services (AD CS) and its immediate use for authentication, indicating potential exploitation of improperly configured certificate templates for privilege escalation.

An attacker exploits CVE-2026-20929 by manipulating DNS responses to redirect Kerberos authentication to attacker-controlled AD CS, enabling certificate enrollment for persistent access.