AN0671
Analytic 0671
Windows
Monitor for abnormal certificate enrollment and usage activity in Active Directory Certificate Services (AD CS), registry access to certificate storage locations, and unusual process executions that attempt to export or access private keys.
WinEventLog:Security
EventCode=4768
WinEventLog:Security
EventCode=4657
[EKU_Thresholds]
Organizations may tune which Extended Key Usage (EKU) values are considered risky.
[TimeWindow]
Defines how quickly multiple certificate enrollments from the same entity should trigger correlation alerts.
[LogonContext]
Differentiate between service accounts and interactive user accounts to reduce false positives.
AN0672
Analytic 0672
Linux
Monitor for file access to certificate directories, commands invoking OpenSSL or PKCS#12 utilities to export or modify certificates, and processes accessing sensitive key storage paths.
auditd:SYSCALL
open, read: /etc/ssl/, /etc/pki/, ~/.pki/nssdb/
auditd:SYSCALL
execve: openssl pkcs12, certutil, keytool
[PathExclusions]
Exempt trusted automated services regularly accessing PKI stores.
[UserContext]
Differentiate root/system accounts versus user-level access to key material.
AN0673
Analytic 0673
macOS
Monitor for security commands and API calls interacting with the Keychain, as well as file access attempts to stored certificates and private keys in ~/Library/Keychains or /Library/Keychains.
macos:unifiedlog
process calling security find-certificate, export, or import
macos:keychain
~/Library/Keychains, /Library/Keychains
[ApplicationAllowList]
Whitelist legitimate apps that interact with Keychain to reduce false positives.
AN0674
Analytic 0674
Identity Provider
Monitor for abnormal certificate enrollment events in identity platforms, unexpected use of token-signing certificates, and unusual CA configuration modifications.
azure:signinlogs
Add certificate credential, Update certificate credential
m365:unified
certificate added or modified in application credentials
[GeoContext]
Detect certificate-related changes occurring from unusual geographic locations.
[Thresholds]
Adjust enrollment/issuance request volume thresholds per tenant size.