https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Analytics-Alert-Reference-by-Alert-name/Suspicious-Certutil-AD-CS-contact?contentId=9g2cqCB3~fTFKStzBp79rg
Suspicious Certutil AD CS contact
Synopsis Activation Period 14 Days Training Period 30 Days Test Period N/A (single event) Deduplication Period 1 Day Required Data Requires: XDR Agent...
ad cssuspiciouscertutil
https://knowledge.broadcom.com/external/article/235609/acf2-certificate-utility-report-certuti.html
ACF2 - Certificate Utility report CERTUTIL presents a Mismatch.
certificateutilityreportcertutilpresents