Certificate Enrollment Web Service Abuse for Forgery
This rule detects potential abuse of a Certificate Enrollment Web Service (typically Microsoft's CertEnroll) for forgery attempts. It specifically looks for HTTP requests to the '/certenroll/' URI on port 80 (HTTP) within the home network. A threshold of 10 such requests from a single source IP within 60 seconds is set to trigger the alert, indicating a possible automated or rapid attempt to interact with the certificate enrollment service.
Suricata
