detection.wiki

Steal or Forge Authentication Certificates T1649

Tactic: Credential Access

Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. For example, Entra ID device certificates and Active Directory Certificate Services (AD CS) certificates bind to an identity and can be used as credentials for domain accounts.

Events covered

14 catalog events are tagged with this technique by at least one rule.

ProviderEventTitle
SysmonEvent ID 1Process creation
SysmonEvent ID 11FileCreate
Security-AuditingEvent ID 4662An operation was performed on an object.
Security-AuditingEvent ID 4688A new process has been created.
Security-AuditingEvent ID 4741A computer account was created.
Security-AuditingEvent ID 4768A Kerberos authentication ticket (TGT) was requested.
Security-AuditingEvent ID 4876Certificate Services backup started.
Security-AuditingEvent ID 4886Certificate Services received a certificate request.
Security-AuditingEvent ID 4887Certificate Services approved a certificate request and issued a certificate.
Security-AuditingEvent ID 5145A network share object was checked to see whether client can be granted desired access.
ESFopenFile Open
CAPI2Event ID 70For more details for this event, please refer to the "Details" section
CertificateServicesClient-Lifecycle-SystemEvent ID 1007A certificate has been exported.
PowerShellEvent ID 4104Creating Scriptblock text (MessageNumber of MessageTotal).

Authoring guide

These 34 rules share fields, values, and exclusions.

Fields filtered most (39 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
EventID14eq 13, in 14887, 4104, 4886, 4688, 1
CommandLine10contains 5, regex_match 3, in 2(?i)request\s.+/ca:.+/(template|altname):, -bloodhound, -ca-pfx , -dc-ip , /altname:
Attributes5contains 4, eq 2, is_not_null 1%known_cdcs%, *san:*upn*, cdc:, certificatetemplate:, rmd:
Channel5eq 5, in 5
eventtype5eq 5
OriginalFileName4eq 4certutil.exe, certify.exe, certipy.exe
ScriptBlockText4contains 3, eq 1, in 1 /ca:, * -ca *, * -u *, cert_system_store_local_machine, crypto::certificates
process_name3eq 2, regex_match 1certutil.exe, (?i)certify\.exe
Description2contains 2certify, certipy
EventType2eq 2microsoft.containerservice/managedclusters/diagnosticlogs/read, open
Image2ends_with 2\certify.exe, \certipy.exe
Type2eq 2
file_name2in 2*.ccache, *.der, *.keyx.rsa.pvk, *.pfx, *_certipy.json
signature_id2regex_match 24688, 4886|4887, 5145
All_Risk.analyticstories1eq 1windows certificate services

Top indicator values (157 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
EventIDeq
4104
3269
EventIDeq
4887
33
EventIDeq
4688
2317
EventIDeq
4886
22
Attributescontains
%known_cdcs%
2
Attributescontains
cdc:
22
Attributescontains
certificatetemplate:
22
Attributescontains
rmd:
1
Attributeseq
*san:*upn*
22
CommandLineregex_match
(?i)request\s.+/ca:.+/(template|altname):
22
OriginalFileNameeq
certutil.exe
230
process_nameeq
certutil.exe
244
signature_idregex_match
4688
28
All_Risk.analyticstorieseq
windows certificate services
1
All_Risk.risk_object_typeeq
system
17
CertThumbprinteq
*
1
CommandLinecontains
-bloodhound
1
CommandLinecontains
-ca-pfx
1
CommandLinecontains
-dc-ip
1
CommandLinecontains
-kirbi
1
CommandLinecontains
-old-bloodhound
1
CommandLinecontains
-pfx
1
CommandLinecontains
-target
1
CommandLinecontains
-template
1
CommandLinecontains
-username
1
CommandLinecontains
-vulnerable
1
CommandLinecontains
/altname:
1
CommandLinecontains
/ca:
1
CommandLinecontains
/domain:
1
CommandLinecontains
/path:
1

Exclusions (10 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
Attributescontains
%known_cdcs%
2
AccessMaskin
0x0
1
AccessMaskin
0x100
1
SubjectUserSideq
s-1-5-18
1
azure.platformlogs.properties.log.user.usernameeq
aksservice
1
azure.platformlogs.properties.log.user.usernameeq
hcpservice
1
azure.platformlogs.properties.log.user.usernameeq
readinesschecker
1
azure.platformlogs.properties.log.user.usernamestarts_with
system:bootstrap:
1
azure.platformlogs.properties.log.user.usernamestarts_with
system:node:
1
azure.platformlogs.properties.log.user.usernamestarts_with
system:serviceaccount:kube-system:
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Sigma 7 rules

Elastic 5 rules

Splunk 22 rules