AD Certificate Services Enumeration via LDAP

api where process.Ext.api.name == "ldap_search" and
 process.Ext.api.parameters.attribute_list == "ntsecuritydescriptor" and
 process.Ext.api.parameters.distinguished_name like "*cn=configuration*" and
 process.Ext.api.parameters.search_filter : (
  "(objectclass=pKIEnrollmentService)",
  "(objectclass=certificationAuthority)",
  "(objectclass=pKICertificateTemplate)",
  "(objectclass=msPKI-Enterprise-Oid)"
  ) and
  not (process.code_signature.subject_name == "Netwrix Corporation" and process.code_signature.trusted == true) and 
  not process.executable :
             ("?:\\Program Files\\Azure Advanced Threat Protection Sensor\\*\\Microsoft.Tri.Sensor.exe",
              "?:\\Windows\\System32\\lsass.exe",
              "?:\\Windows\\ADFS\\Microsoft.IdentityServer.ServiceHost.exe",
              "?:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe",
              "?:\\Program Files\\Semperis\\Management Server\\Semperis.TaskServerSvcHost.exe")