{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1649","id":"T1649","name":"Steal or Forge Authentication Certificates","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1649","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"535db38e2c69eb5eecc5474fb1c1fa4cde85a4dd314e0ba8838ca14dddcb177c","description":"Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. For example, Entra ID device certificates and Active Directory Certificate Services (AD CS) certificates bind to an identity and can be used as credentials for domain accounts.(Citation: O365 Blog Azure AD Device IDs)(Citation: Microsoft AD CS Overview)\n\nAuthentication certificates can be both stolen and forged. For example, AD CS certificates can be stolen from encrypted storage (in the Registry or files)(Citation: APT29 Deep Look at Credential Roaming), misplaced certificate files (i.e. [Unsecured Credentials](https://attack.mitre.org/techniques/T1552)), or directly from the Windows certificate store via various crypto APIs.(Citation: SpecterOps Certified Pre Owned)(Citation: GitHub CertStealer)(Citation: GitHub GhostPack Certificates) With appropriate enrollment rights, users and/or machines within a domain can also request and/or manually renew certificates from enterprise certificate authorities (CA). This enrollment process defines various settings and permissions associated with the certificate. Of note, the certificate’s extended key usage (EKU) values define signing, encryption, and authentication use cases, while the certificate’s subject alternative name (SAN) values define the certificate owner’s alternate names.(Citation: Medium Certified Pre Owned)\n\nAbusing certificates for authentication credentials may enable other behaviors such as [Lateral Movement](https://attack.mitre.org/tactics/TA0008). Certificate-related misconfigurations may also enable opportunities for [Privilege Escalation](https://attack.mitre.org/tactics/TA0004), by way of allowing users to impersonate or assume privileged accounts or permissions via the identities (SANs) associated with a certificate. These abuses may also enable [Persistence](https://attack.mitre.org/tactics/TA0003) via stealing or forging certificates that can be used as [Valid Accounts](https://attack.mitre.org/techniques/T1078) for the duration of the certificate's validity, despite user password resets. Authentication certificates can also be stolen and forged for machine accounts.\n\nAdversaries who have access to root (or subordinate) CA certificate private keys (or mechanisms protecting/managing these keys) may also establish [Persistence](https://attack.mitre.org/tactics/TA0003) by forging arbitrary authentication certificates for the victim domain (known as “golden” certificates).(Citation: Medium Certified Pre Owned) Adversaries may also target certificates and related services in order to access other forms of credentials, such as [Golden Ticket](https://attack.mitre.org/techniques/T1558/001) ticket-granting tickets (TGT) or NTLM plaintext.(Citation: Medium Certified Pre Owned)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1649","external_id":"T1649"},{"source_name":"GitHub GhostPack Certificates","description":"HarmJ0y. (2018, August 22). SharpDPAPI - Certificates. Retrieved August 2, 2022.","url":"https://github.com/GhostPack/SharpDPAPI#certificates"},{"source_name":"Microsoft AD CS Overview","description":"Microsoft. (2016, August 31). Active Directory Certificate Services Overview. Retrieved August 2, 2022.","url":"https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831740(v=ws.11)"},{"source_name":"Medium Certified Pre Owned","description":"Schroeder, W. (2021, June 17). Certified Pre-Owned. Retrieved August 2, 2022.","url":"https://posts.specterops.io/certified-pre-owned-d95910965cd2"},{"source_name":"SpecterOps Certified Pre Owned","description":"Schroeder, W. & Christensen, L. (2021, June 22). Certified Pre-Owned - Abusing Active Directory Certificate Services. Retrieved August 2, 2022.","url":"https://web.archive.org/web/20220818094600/https://specterops.io/assets/resources/Certified_Pre-Owned.pdf"},{"source_name":"O365 Blog Azure AD Device IDs","description":"Syynimaa, N. (2022, February 15). Stealing and faking Azure AD device identities. Retrieved August 3, 2022.","url":"https://o365blog.com/post/deviceidentity/"},{"source_name":"GitHub CertStealer","description":"TheWover. (2021, April 21). CertStealer. Retrieved August 2, 2022.","url":"https://github.com/TheWover/CertStealer"},{"source_name":"APT29 Deep Look at Credential Roaming","description":"Thibault Van Geluwe De Berlaere. (2022, November 8). They See Me Roaming: Following APT29 by Taking a Deeper Look at Windows Credential Roaming. Retrieved November 9, 2022.","url":"https://www.mandiant.com/resources/blog/apt29-windows-credential-roaming"}],"platforms":["Windows","Linux","macOS","Identity Provider"],"environments":["cloud-hosted-endpoint","identity","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0084","name":"Active Directory Credential Request","page":"telemetry/DC0084/","kind":"attack_component","category":"Windows and directory audit","description":"Directory authentication service requests, such as Kerberos ticket requests.","collection_focus":"Enable the relevant Account Logon subcategories on DCs, including Kerberos Authentication Service and Service Ticket Operations; preserve service/account, encryption and result.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"},{"name":"Active Directory domain controllers","scope":"Directory changes and authentication records; collect from the relevant controllers, not only endpoints.","source_id":"ad"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["account","service_principal","request_type","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0084","collector":"illustrative-lab-collector","observation":{"account":"lab-user","service_principal":"cifs/lab-server.example.test","request_type":"service_ticket","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0066","name":"Active Directory Object Modification","page":"telemetry/DC0066/","kind":"attack_component","category":"Windows and directory audit","description":"Modification of an Active Directory object attribute.","collection_focus":"Enable Audit Directory Service Changes with appropriate object SACLs on lab DCs; retain 5136 attribute/value and correlation context.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"},{"name":"Active Directory domain controllers","scope":"Directory changes and authentication records; collect from the relevant controllers, not only endpoints.","source_id":"ad"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["object_dn","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0066","collector":"illustrative-lab-collector","observation":{"object_dn":"CN=LabUser,OU=Lab,DC=example,DC=test","attribute":"description","before":"Lab account","after":"Lab account reviewed"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0055","name":"File Access","page":"telemetry/DC0055/","kind":"attack_component","category":"Windows and directory audit","description":"Access to file objects with user, process and access-right context.","collection_focus":"Enable Audit File System plus a narrow SACL on a lab directory; on Linux select path/syscall rules and join associated Audit records.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["path","access","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0050","name":"Windows Registry Key Access","page":"telemetry/DC0050/","kind":"attack_component","category":"Windows and directory audit","description":"Access to a Windows registry key, rather than only changes to its values.","collection_focus":"Enable Audit Registry and narrow SACLs for the lab keys; collect access rights and result. Sysmon registry events do not log every read.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["registry_path","access","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0050","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab","access":"query_value","actor":"LAB\\analyst","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."}],"detection":{"key":"enterprise/T1649","id":"T1649","name":"Steal or Forge Authentication Certificates","domain":"enterprise","platforms":["Windows","Linux","macOS","Identity Provider"],"environments":["cloud-hosted-endpoint","identity","onprem"],"source_url":"https://attack.mitre.org/techniques/T1649","technique_page":"techniques/enterprise/T1649/","page":"detections/enterprise/T1649/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[{"id":"e2b5163d-7deb-4566-9af3-40afea6858c3","title":"Certificate Private Key Acquired","status":"test","level":"medium","logsource":{"product":"windows","service":"capi2","definition":"Requirements: The CAPI2 Operational log needs to be enabled"},"data_path":"data/detection-rules/e2b5163d-7deb-4566-9af3-40afea6858c3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/capi2/win_capi2_acquire_certificate_private_key.yml","author":"Zach Mathis","kind":"sigma"},{"id":"58c0bff0-40a0-46e8-b5e8-b734b84d2017","title":"Certificate Exported From Local Certificate Store","status":"test","level":"medium","logsource":{"product":"windows","service":"certificateservicesclient-lifecycle-system"},"data_path":"data/detection-rules/58c0bff0-40a0-46e8-b5e8-b734b84d2017.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/certificate_services_client_lifecycle_system/win_certificateservicesclient_lifecycle_system_cert_exported.yml","author":"Zach Mathis","kind":"sigma"},{"id":"762f2482-ff21-4970-8939-0aa317a886bb","title":"HackTool - Certify Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/762f2482-ff21-4970-8939-0aa317a886bb.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_certify.yml","author":"pH-T (Nextron Systems)","kind":"sigma"},{"id":"6938366d-8954-4ddc-baff-c830b3ba8fcd","title":"HackTool - Certipy Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/6938366d-8954-4ddc-baff-c830b3ba8fcd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_certipy.yml","author":"pH-T (Nextron Systems), Sittikorn Sangrattanapitak","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0240","name":"Detection Strategy for Steal or Forge Authentication Certificates","url":"https://attack.mitre.org/detectionstrategies/DET0240","stix_id":"x-mitre-detection-strategy--7b0ea292-22f5-4963-b1c2-0d396fb17619","relationship_id":"relationship--12a19faf-b1ea-4eee-b921-059a2f65622a","description":"","analytics":[{"id":"AN0671","name":"Analytic 0671","guidance":"Monitor for abnormal certificate enrollment and usage activity in Active Directory Certificate Services (AD CS), registry access to certificate storage locations, and unusual process executions that attempt to export or access private keys.","url":"https://attack.mitre.org/detectionstrategies/DET0240#AN0671","platforms":["Windows"],"tuning":[{"field":"EKU_Thresholds","description":"Organizations may tune which Extended Key Usage (EKU) values are considered risky."},{"field":"TimeWindow","description":"Defines how quickly multiple certificate enrollments from the same entity should trigger correlation alerts."},{"field":"LogonContext","description":"Differentiate between service accounts and interactive user accounts to reduce false positives."}],"log_sources":[{"component_id":"DC0084","component":"Active Directory Credential Request","name":"WinEventLog:Security","channel":"EventCode=4768","platforms":["Windows"],"analytic_id":"AN0671","source_url":"https://attack.mitre.org/detectionstrategies/DET0240#AN0671","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0084/"},{"component_id":"DC0050","component":"Windows Registry Key Access","name":"WinEventLog:Security","channel":"EventCode=4657","platforms":["Windows"],"analytic_id":"AN0671","source_url":"https://attack.mitre.org/detectionstrategies/DET0240#AN0671","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0050/"}]},{"id":"AN0672","name":"Analytic 0672","guidance":"Monitor for file access to certificate directories, commands invoking OpenSSL or PKCS#12 utilities to export or modify certificates, and processes accessing sensitive key storage paths.","url":"https://attack.mitre.org/detectionstrategies/DET0240#AN0672","platforms":["Linux"],"tuning":[{"field":"PathExclusions","description":"Exempt trusted automated services regularly accessing PKI stores."},{"field":"UserContext","description":"Differentiate root/system accounts versus user-level access to key material."}],"log_sources":[{"component_id":"DC0055","component":"File Access","name":"auditd:SYSCALL","channel":"open, read: /etc/ssl/, /etc/pki/, ~/.pki/nssdb/","platforms":["Linux"],"analytic_id":"AN0672","source_url":"https://attack.mitre.org/detectionstrategies/DET0240#AN0672","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"},{"component_id":"DC0064","component":"Command Execution","name":"auditd:SYSCALL","channel":"execve: openssl pkcs12, certutil, keytool","platforms":["Linux"],"analytic_id":"AN0672","source_url":"https://attack.mitre.org/detectionstrategies/DET0240#AN0672","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN0673","name":"Analytic 0673","guidance":"Monitor for security commands and API calls interacting with the Keychain, as well as file access attempts to stored certificates and private keys in ~/Library/Keychains or /Library/Keychains.","url":"https://attack.mitre.org/detectionstrategies/DET0240#AN0673","platforms":["macOS"],"tuning":[{"field":"ApplicationAllowList","description":"Whitelist legitimate apps that interact with Keychain to reduce false positives."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"macos:unifiedlog","channel":"process calling security find-certificate, export, or import","platforms":["macOS"],"analytic_id":"AN0673","source_url":"https://attack.mitre.org/detectionstrategies/DET0240#AN0673","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0055","component":"File Access","name":"macos:keychain","channel":"~/Library/Keychains, /Library/Keychains","platforms":["macOS"],"analytic_id":"AN0673","source_url":"https://attack.mitre.org/detectionstrategies/DET0240#AN0673","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"}]},{"id":"AN0674","name":"Analytic 0674","guidance":"Monitor for abnormal certificate enrollment events in identity platforms, unexpected use of token-signing certificates, and unusual CA configuration modifications.","url":"https://attack.mitre.org/detectionstrategies/DET0240#AN0674","platforms":["Identity Provider"],"tuning":[{"field":"GeoContext","description":"Detect certificate-related changes occurring from unusual geographic locations."},{"field":"Thresholds","description":"Adjust enrollment/issuance request volume thresholds per tenant size."}],"log_sources":[{"component_id":"DC0066","component":"Active Directory Object Modification","name":"azure:signinlogs","channel":"Add certificate credential, Update certificate credential","platforms":["Identity Provider"],"analytic_id":"AN0674","source_url":"https://attack.mitre.org/detectionstrategies/DET0240#AN0674","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0066/"},{"component_id":"DC0038","component":"Application Log Content","name":"m365:unified","channel":"certificate added or modified in application credentials","platforms":["Identity Provider"],"analytic_id":"AN0674","source_url":"https://attack.mitre.org/detectionstrategies/DET0240#AN0674","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]}]}],"telemetry_references":[{"id":"DC0084","name":"Active Directory Credential Request","tag":"Active Directory Credential Request","page":"telemetry/DC0084/","kind":"attack_component"},{"id":"DC0066","name":"Active Directory Object Modification","tag":"Active Directory Object Modification","page":"telemetry/DC0066/","kind":"attack_component"},{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0055","name":"File Access","tag":"File Access","page":"telemetry/DC0055/","kind":"attack_component"},{"id":"DC0050","name":"Windows Registry Key Access","tag":"Windows Registry Key Access","page":"telemetry/DC0050/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0677","name":"AADInternals","page":"tools/S0677/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0002","name":"Mimikatz","page":"tools/S0002/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0677","name":"AADInternals","page":"tools/S0677/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0002","name":"Mimikatz","page":"tools/S0002/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0002","name":"Mimikatz","url":"https://attack.mitre.org/software/S0002","kind":"tool","description":"[Mimikatz](https://attack.mitre.org/software/S0002)'s `CRYPTO` module can create and export various types of authentication certificates.(Citation: Adsecurity Mimikatz Guide)","relationship_id":"relationship--ed48d88f-840e-4653-84df-7181afc6dfd3","references":[{"source_name":"Adsecurity Mimikatz Guide","description":"Metcalf, S. (2015, November 13). Unofficial Guide to Mimikatz & Command Reference. Retrieved December 23, 2015.","url":"https://adsecurity.org/?page_id=1821"}]},{"id":"S0677","name":"AADInternals","url":"https://attack.mitre.org/software/S0677","kind":"tool","description":"[AADInternals](https://attack.mitre.org/software/S0677) can create and export various authentication certificates, including those associated with Azure AD joined/registered devices.(Citation: AADInternals Documentation)","relationship_id":"relationship--234867ce-57bb-41c6-beb5-af9cc00e1a39","references":[{"source_name":"AADInternals Documentation","description":"Dr. Nestori Syynimaa. (2018, October 25). AADInternals. Retrieved February 18, 2022.","url":"https://o365blog.com/aadinternals"}]},{"id":"S9043","name":"Mini Shai-Hulud","url":"https://attack.mitre.org/software/S9043","kind":"malware","description":"[Mini Shai-Hulud](https://attack.mitre.org/software/S9043) has collected victim client certificates to assist in signed authentication assertion with Azure environments.(Citation: Hunt.io TeamPCP Toolkit MAY 2026)","relationship_id":"relationship--87096c2d-3bf1-41e7-8fd2-34f0860ac02e","references":[{"source_name":"Hunt.io TeamPCP Toolkit MAY 2026","description":"Hunt.io. (2026, May 14). How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account. Retrieved July 16, 2026.","url":"https://hunt.io/blog/teampcp-python-toolkit-firescale-github-c2-takedown"}]}],"actors":[{"id":"G0016","name":"APT29","url":"https://attack.mitre.org/groups/G0016","kind":"intrusion-set","description":"[APT29](https://attack.mitre.org/groups/G0016) has abused misconfigured AD CS certificate templates to impersonate admin users and create additional authentication certificates.(Citation: Mandiant APT29 Trello)","relationship_id":"relationship--ca1a0b5b-f07e-4017-8d9e-da784a75dc37","references":[{"source_name":"Mandiant APT29 Trello","description":"Wolfram, J. et al. (2022, April 28). Trello From the Other Side: Tracking APT29 Phishing Campaigns. Retrieved August 3, 2022.","url":"https://www.mandiant.com/resources/tracking-apt29-phishing-campaigns"}]},{"id":"G1059","name":"NIMBUS MANTICORE","url":"https://attack.mitre.org/groups/G1059","kind":"intrusion-set","description":"[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has stolen and leveraged vulnerable Active Directory Certificate Services templates to impersonate higher-privileged user accounts.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ","relationship_id":"relationship--2ed9bf1f-0fd9-4e11-b510-dbf3f7312385","references":[{"source_name":"Mandiant_UNC1549TTPsTools_Nov2025","description":"El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}]}],"mitigations":[{"id":"M1015","name":"Active Directory Configuration","url":"https://attack.mitre.org/mitigations/M1015","kind":"course-of-action","description":"Ensure certificate authorities (CA) are properly secured, including treating CA servers (and other resources hosting CA certificates) as tier 0 assets. Harden abusable CA settings and attributes.\n\nFor example, consider disabling the usage of AD CS certificate SANs within relevant authentication protocol settings to enforce strict user mappings and prevent certificates from authenticating as other identifies.(Citation: SpecterOps Certified Pre Owned) Also consider enforcing CA Certificate Manager approval for the templates that include SAN as an issuance requirement.","relationship_id":"relationship--35228466-b834-474f-8657-a3492a3579b6","references":[{"source_name":"SpecterOps Certified Pre Owned","description":"Schroeder, W. & Christensen, L. (2021, June 22). Certified Pre-Owned - Abusing Active Directory Certificate Services. Retrieved August 2, 2022.","url":"https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf"}]},{"id":"M1041","name":"Encrypt Sensitive Information","url":"https://attack.mitre.org/mitigations/M1041","kind":"course-of-action","description":"Ensure certificates as well as associated private keys are appropriately secured. Consider utilizing additional hardware credential protections such as trusted platform modules (TPM) or hardware security modules (HSM). Enforce HTTPS and enable Extended Protection for\nAuthentication.(Citation: SpecterOps Certified Pre Owned)","relationship_id":"relationship--98b6508c-5f00-4c06-a906-4fd7ce74bc62","references":[{"source_name":"SpecterOps Certified Pre Owned","description":"Schroeder, W. & Christensen, L. (2021, June 22). Certified Pre-Owned - Abusing Active Directory Certificate Services. Retrieved August 2, 2022.","url":"https://web.archive.org/web/20220818094600/https://specterops.io/assets/resources/Certified_Pre-Owned.pdf"}]},{"id":"M1042","name":"Disable or Remove Feature or Program","url":"https://attack.mitre.org/mitigations/M1042","kind":"course-of-action","description":"Consider disabling old/dangerous authentication protocols (e.g. NTLM), as well as unnecessary certificate features, such as potentially vulnerable AD CS web and other enrollment server roles.(Citation: SpecterOps Certified Pre Owned)","relationship_id":"relationship--3881a82b-37fa-4e91-a411-a0f2b4410749","references":[{"source_name":"SpecterOps Certified Pre Owned","description":"Schroeder, W. & Christensen, L. (2021, June 22). Certified Pre-Owned - Abusing Active Directory Certificate Services. Retrieved August 2, 2022.","url":"https://web.archive.org/web/20220818094600/https://specterops.io/assets/resources/Certified_Pre-Owned.pdf"}]},{"id":"M1047","name":"Audit","url":"https://attack.mitre.org/mitigations/M1047","kind":"course-of-action","description":"Check and remediate unneeded existing authentication certificates as well as common abusable misconfigurations of CA settings and permissions, such as AD CS certificate enrollment permissions and published overly permissive certificate templates (which define available settings for created certificates). For example, available AD CS certificate templates can be checked via the Certificate Authority MMC snap-in (`certsrv.msc`). `certutil.exe` can also be used to examine various information within an AD CS CA database.(Citation: SpecterOps Certified Pre Owned)(Citation: GitHub PSPKIAudit)(Citation: GitHub Certify)","relationship_id":"relationship--d3a4a83f-fac1-4e28-b1e8-183aabffaa34","references":[{"source_name":"GitHub PSPKIAudit","description":"HarmJ0y et al. (2021, June 16). PSPKIAudit. Retrieved August 2, 2022.","url":"https://github.com/GhostPack/PSPKIAudit"},{"source_name":"GitHub Certify","description":"HarmJ0y et al. (2021, June 9). Certify. Retrieved August 4, 2022.","url":"https://github.com/GhostPack/Certify/"},{"source_name":"SpecterOps Certified Pre Owned","description":"Schroeder, W. & Christensen, L. (2021, June 22). Certified Pre-Owned - Abusing Active Directory Certificate Services. Retrieved August 2, 2022.","url":"https://web.archive.org/web/20220818094600/https://specterops.io/assets/resources/Certified_Pre-Owned.pdf"}]}],"candidates":[{"id":"eb121494-82d1-4148-9e2b-e624e03fbf3d","name":"Staging Local Certificates via Export-Certificate","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1649/T1649.yaml","description":"Export all user certificates and add to a compressed archive.\n","inputs":{},"dependencies":[],"source_definition_sha256":"be44054397925a0e39107feee251cf3d6f97b289e9c8b7fb013f26d25e943870"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1552":"/ttp-simulation/techniques/enterprise/T1552/","T1078":"/ttp-simulation/techniques/enterprise/T1078/","T1558.001":"/ttp-simulation/techniques/enterprise/T1558.001/","T1649":"/ttp-simulation/techniques/enterprise/T1649/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1649","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0084","collector":"illustrative-lab-collector","observation":{"account":"lab-user","service_principal":"cifs/lab-server.example.test","request_type":"service_ticket","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0066","collector":"illustrative-lab-collector","observation":{"object_dn":"CN=LabUser,OU=Lab,DC=example,DC=test","attribute":"description","before":"Lab account","after":"Lab account reviewed"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0050","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab","access":"query_value","actor":"LAB\\analyst","result":"success"}}]}}