Detects potential abuse of Active Directory Certificate Services (AD CS) in which a successful certificate issuance (event 4887) is tied to a machine-account requester that differs from the Remote Machine Discovery (RMD) chase target, while the certificate SAN matches that target. The rule parses certificate-related attributes (CertificateTemplate, SAN) from winlog.event_data.Attributes or dedicated SAN fields and the SubjectAlternativeName, normalizes values (lowercasing, removing domain prefixes, shortening to DNS label for comparison), and flags cases where normalized_requester != normalized_rmd_target but normalized_san_target == normalized_rmd_target. This indicates a possible CertiGhost-like scenario (CVE-2026-54121) or similar mis-use of AD CS request-context chase processing. The rule uses a fallback parsing path when dedicated fields are absent and preserves key context (Requester, SAN, RMD, CertificateTemplate) for triage. It provides structured triage guidance, investigation steps, and remediation actions. It maps to MITRE ATT&CK techniques that involve forging or abusing certificates and credential access, highlighting the risk of credential abuse and possible privilege escalation stemming from certificate misuse.