Blog Labs References

Detection rules › By event

Microsoft-Windows-Security-Auditing event 4887

3 detection rules reference this event. View event page.

Splunk (3)

Windows Steal Authentication Certificates - ESC1 Abuse T1649
Windows Steal Authentication Certificates - ESC1 Authentication T1550, T1649
Windows Steal Authentication Certificates Certificate Issued T1649

Keyboard Shortcuts

j / k: Scroll down / up
d / u: Half-page down / up
h / l: Go back / forward
gg: Go to top
G: Go to bottom
f: Follow link (SHIFT = new tab)
/: Focus search
?: Toggle this help

See Navigation Reference for search modifiers and filters.