{"id":"T1608.003","name":"Install Digital Certificate","url":"https://attack.mitre.org/techniques/T1608/003","tactics":["resource-development"],"platforms":["PRE"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0840","stix_id":"x-mitre-detection-strategy--ad99833c-d2de-45be-a20b-9cbb6d797a35","name":"Detection of Install Digital Certificate","url":"https://attack.mitre.org/detectionstrategies/DET0840","analytics":[{"id":"AN1972","stix_id":"x-mitre-analytic--a05f564d-365c-46ce-ab98-ba377aa3b660","name":"Analytic 1972","description":"Consider use of services that may aid in the tracking of certificates in use on sites across the Internet. In some cases it may be possible to pivot on known pieces of certificate information to uncover other adversary infrastructure.(Citation: Splunk Kovar Certificates 2017)\nDetection efforts may be focused on related behaviors, such as [Web Protocols](https://attack.mitre.org/techniques/T1071/001) or [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002).","url":"https://attack.mitre.org/detectionstrategies/DET0840#AN1972","platforms":["PRE"],"log_source_references":[{"name":"Internet Scan","channel":"None","data_component":"DC0104","data_component_name":"Response Content","log_source_slug":"internet-scan"}],"mutable_elements":[],"live":true,"detection_strategies":["DET0840"],"techniques":["T1608.003"]}],"live":true,"version":"1.0","techniques":["T1608.003"]}],"sigma_rules":[{"id":"1279262f-1464-422f-ac0d-5b545320c526","title":"AWS KMS Imported Key Material Usage","author":"toopricey","status":"experimental","level":"high","date":"2025-10-18","modified":null,"description":"Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal.\n","references":["https://www.chrisfarris.com/post/effective-aws-ransomware/","https://docs.aws.amazon.com/kms/latest/developerguide/ct-importkeymaterial.html","https://docs.aws.amazon.com/kms/latest/developerguide/ct-deleteimportedkeymaterial.html"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.impact","attack.t1486","attack.resource-development","attack.t1608.003"],"path":"rules/cloud/aws/cloudtrail/aws_kms_import_key_material.yml","techniques":["T1486","T1608.003"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}