Techniques › T1587 › T1587.003
T1587.003 Digital Certificates
resource development — PRE · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
0
Sigma rules tagged attack.t1587.003
0
KEV CVEs mapped here
<p>Adversaries may create self-signed SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. In the case of self-signing, digital certificates will lack the element of trust associated with the signature of a third-party certificate authority (CA).</p><p>Adversaries may create self-signed SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: Asymmetric Cryptography with Web Protocols) or even enabling Adversary-in-the-Middle if added to the root of trust (i.e. Install Root Certificate).</p><p>After creating a digital certificate, an adversary may then install that certificate (see Install Digital Certificate) on infrastructure under their control.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0844 Detection of Digital Certificates v1.0
AN1976 PREConsider use of services that may aid in the tracking of certificates in use on sites across the Internet. In some cases it may be possible to pivot on known pieces of certificate information to uncover other adversary infrastructure. Detection efforts may be focused on related behaviors, such as Web Protocols , Asymmetric Cryptography , and/or Install Root Certificate .
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1587.003
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.
Rules tagged at the parent level (attack.t1587) 6
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Florian Roth (Nextron Systems)
· 2021-06-29 (modified 2022-12-25) · logsource: product=windows category=file_event · 2131cfb3-8c12-45e8-8fa0-31f5924e9f07
Detects the default filename used in PoC code against print spooler vulnerability CVE-2021-1675
Author: Florian Roth (Nextron Systems), Sittikorn S
· 2021-09-10 (modified 2023-06-22) · logsource: product=windows category=file_event · 60c0a111-787a-4e8a-9262-ee485f3ef9d5
Detects file creation patterns noticeable during the exploitation of CVE-2021-40444
Author: Florian Roth (Nextron Systems)
· 2021-09-27 (modified 2022-12-09) · logsource: product=windows category=image_load · 640dc51c-7713-4faa-8a0e-e7c0d9d4654c
Detects DLL hijacking technique used by NOBELIUM in their FoggyWeb backdoor. Which loads a malicious version of the expected "version.dll" dll
Author: Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])
· 2023-01-03 (modified 2024-09-19) · logsource: product=linux category=process_creation · a015e032-146d-4717-8944-7a1884122111
Detects known hacktool execution based on image name.
Author: Florian Roth (Nextron Systems)
· 2018-01-23 (modified 2021-11-27) · logsource: product=linux service=auditd · a39d7fa7-3fbd-4dc2-97e1-d87f546b1bbc
Detects program executions in suspicious non-program folders related to malware or hacking activity
Author: Florian Roth (Nextron Systems)
· 2021-06-18 (modified 2023-02-05) · logsource: product=windows category=process_creation · ff23ffbc-3378-435e-992f-0624dcf93ab4
Detects the execution of the PurpleSharp adversary simulation tool