1200KM / simulation
Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. For example, Entra ID device certificates and Active Directory Certificate Services (AD CS) certificates bind to an identity and can be used as credentials for domain accounts. Authentication certificates can…
Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. For example, Entra ID device certificates and Active Directory Certificate Services (AD CS) certificates bind to an identity and can be used as credentials for domain accounts.[O365 Blog Azure AD Device IDs][Microsoft AD CS Overview]
Authentication certificates can be both stolen and forged. For example, AD CS certificates can be stolen from encrypted storage (in the Registry or files)[APT29 Deep Look at Credential Roaming], misplaced certificate files (i.e. Unsecured Credentials), or directly from the Windows certificate store via various crypto APIs.[SpecterOps Certified Pre Owned][GitHub CertStealer][GitHub GhostPack Certificates] With appropriate enrollment rights, users and/or machines within a domain can also request and/or manually renew certificates from enterprise certificate authorities (CA). This enrollment process defines various settings and permissions associated with the certificate. Of note, the certificate’s extended key usage (EKU) values define signing, encryption, and authentication use cases, while the certificate’s subject alternative name (SAN) values define the certificate owner’s alternate names.[Medium Certified Pre Owned]
Abusing certificates for authentication credentials may enable other behaviors such as Lateral Movement. Certificate-related misconfigurations may also enable opportunities for Privilege Escalation, by way of allowing users to impersonate or assume privileged accounts or permissions via the identities (SANs) associated with a certificate. These abuses may also enable Persistence via stealing or forging certificates that can be used as Valid Accounts for the duration of the certificate's validity, despite user password resets. Authentication certificates can also be stolen and forged for machine accounts.
Adversaries who have access to root (or subordinate) CA certificate private keys (or mechanisms protecting/managing these keys) may also establish Persistence by forging arbitrary authentication certificates for the victim domain (known as “golden” certificates).[Medium Certified Pre Owned] Adversaries may also target certificates and related services in order to access other forms of credentials, such as Golden Ticket ticket-granting tickets (TGT) or NTLM plaintext.[Medium Certified Pre Owned]
Official technique definition · Open in the interactive matrix
These contracts are selected through exact technique-to-data-component relationships or explicitly labelled planning overrides. Configure a collector at the relevant observation point; a telemetry name alone is not coverage.
DC0084 collection page — Enable the relevant Account Logon subcategories on DCs, including Kerberos Authentication Service and Service Ticket Operations; preserve service/account, encryption and result.
Required normalized fields: account, service_principal, request_type, result.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0084",
"collector": "illustrative-lab-collector",
"observation": {
"account": "lab-user",
"service_principal": "cifs/lab-server.example.test",
"request_type": "service_ticket",
"result": "success"
}
}Visibility limits: A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.
DC0066 collection page — Enable Audit Directory Service Changes with appropriate object SACLs on lab DCs; retain 5136 attribute/value and correlation context.
Required normalized fields: object_dn, attribute, before, after.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0066",
"collector": "illustrative-lab-collector",
"observation": {
"object_dn": "CN=LabUser,OU=Lab,DC=example,DC=test",
"attribute": "description",
"before": "Lab account",
"after": "Lab account reviewed"
}
}Visibility limits: A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.
DC0038 collection page — Select the application event family required by the detection and document its native schema before normalization.
Required normalized fields: service, action, actor, record_count, result.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0038",
"collector": "illustrative-lab-collector",
"observation": {
"service": "lab-portal",
"action": "export_requested",
"actor": "lab-reader",
"record_count": 3,
"result": "authorized"
}
}Visibility limits: Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.
DC0064 collection page — Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.
Required normalized fields: interpreter, command_line, actor_uid, session_id.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0064",
"collector": "illustrative-lab-collector",
"observation": {
"interpreter": "/bin/sh",
"command_line": "printf LAB_TELEMETRY_CHECK",
"actor_uid": 1000,
"session_id": "lab-session-1"
}
}Visibility limits: Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.
DC0055 collection page — Enable Audit File System plus a narrow SACL on a lab directory; on Linux select path/syscall rules and join associated Audit records.
Required normalized fields: path, access, actor, result.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0055",
"collector": "illustrative-lab-collector",
"observation": {
"path": "C:\\Lab\\demo.txt",
"access": "read",
"actor": "LAB\\analyst",
"result": "success"
}
}Visibility limits: A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.
DC0050 collection page — Enable Audit Registry and narrow SACLs for the lab keys; collect access rights and result. Sysmon registry events do not log every read.
Required normalized fields: registry_path, access, actor, result.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0050",
"collector": "illustrative-lab-collector",
"observation": {
"registry_path": "HKCU\\Software\\Lab",
"access": "query_value",
"actor": "LAB\\analyst",
"result": "success"
}
}Visibility limits: A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.
Open the dedicated detection workspace · Existing query engineering
Monitor for abnormal certificate enrollment and usage activity in Active Directory Certificate Services (AD CS), registry access to certificate storage locations, and unusual process executions that attempt to export or access private keys.
Platforms: Windows.
Monitor for file access to certificate directories, commands invoking OpenSSL or PKCS#12 utilities to export or modify certificates, and processes accessing sensitive key storage paths.
Platforms: Linux.
Monitor for security commands and API calls interacting with the Keychain, as well as file access attempts to stored certificates and private keys in ~/Library/Keychains or /Library/Keychains.
Platforms: macOS.
Monitor for abnormal certificate enrollment events in identity platforms, unexpected use of token-signing certificates, and unusual CA configuration modifications.
Platforms: Identity Provider.
4 exact-tagged source rules. A source tag is a discovery aid, not a relevance verdict. Check the observation point and actual condition of each rule.
No exact technique-specific Atlas model is present for T1649 in the selected source snapshot. The following is a design worksheet, not a newly validated model.
Start from the exact analytic above. The collection-specific lenses below are analyst recommendations; they do not assert that an arbitrary statistical deviation detects this technique.
Anomaly Detection Atlas · Baseline, validation and blind spots
These are exact ATT&CK software-use relationships, including malware. They provide behavior context, not recommendations to download or execute malware. No safety or detector claim is inherited.
Mimikatz's `CRYPTO` module can create and export various types of authentication certificates.[Adsecurity Mimikatz Guide]
Exact relationship: relationship--ed48d88f-840e-4653-84df-7181afc6dfd3AADInternals can create and export various authentication certificates, including those associated with Azure AD joined/registered devices.[AADInternals Documentation]
Exact relationship: relationship--234867ce-57bb-41c6-beb5-af9cc00e1a39Mini Shai-Hulud has collected victim client certificates to assist in signed authentication assertion with Azure environments.[Hunt.io TeamPCP Toolkit MAY 2026]
Exact relationship: relationship--87096c2d-3bf1-41e7-8fd2-34f0860ac02eAtomic evidence: 1 compatible documented candidates. Live lab status: not run for these imported procedures.
Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.
Export all user certificates and add to a compressed archive.
Pinned Atomic procedure · eb121494-82d1-4148-9e2b-e624e03fbf3d · windows · powershell.
Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Download synthetic collection fixture (JSON) · Download the complete engineering workbook
This fixture exercises the listed collection fields. It does not reproduce Steal or Forge Authentication Certificates, label its example events as malicious, or measure detection effectiveness. Use the exact analytic and selected procedure to build an independently labelled behavior-positive dataset.
Not run in this browser. No network scan or attack command is executed by this control.
All-page audit and evidence inventory · This page’s machine-readable workbook
Pinned MITRE STIX source · SHA-256 81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352. Definition and procedure context are reproduced from this snapshot, not independently re-investigated incidents.
Ensure certificate authorities (CA) are properly secured, including treating CA servers (and other resources hosting CA certificates) as tier 0 assets. Harden abusable CA settings and attributes.
For example, consider disabling the usage of AD CS certificate SANs within relevant authentication protocol settings to enforce strict user mappings and prevent certificates from authenticating as other identifies.[SpecterOps Certified Pre Owned] Also consider enforcing CA Certificate Manager approval for the templates that include SAN as an issuance requirement.
Ensure certificates as well as associated private keys are appropriately secured. Consider utilizing additional hardware credential protections such as trusted platform modules (TPM) or hardware security modules (HSM). Enforce HTTPS and enable Extended Protection for Authentication.[SpecterOps Certified Pre Owned]
Consider disabling old/dangerous authentication protocols (e.g. NTLM), as well as unnecessary certificate features, such as potentially vulnerable AD CS web and other enrollment server roles.[SpecterOps Certified Pre Owned]
Check and remediate unneeded existing authentication certificates as well as common abusable misconfigurations of CA settings and permissions, such as AD CS certificate enrollment permissions and published overly permissive certificate templates (which define available settings for created certificates). For example, available AD CS certificate templates can be checked via the Certificate Authority MMC snap-in (`certsrv.msc`). `certutil.exe` can also be used to examine various information within an AD CS CA database.[SpecterOps Certified Pre Owned][GitHub PSPKIAudit][GitHub Certify]
Source procedure platform / method / executor tags:
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.