Stage Capabilities: Install Digital Certificate

Adversaries may install SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are files that can be installed on servers to enable secure communications between systems. Digital certificates include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate securely with its owner. Certificates can be uploaded to a server, then the server can be configured to use the certificate to enable encrypted communication with it.[1]


Adversaries may install SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: Asymmetric Cryptography with Web Protocols) or lending credibility to a credential harvesting site. Installation of digital certificates may take place for a number of server types, including web servers and email servers.

攻撃者は、C2トラフィックの暗号化(ex: ウェブプロトコルによる非対称暗号) や認証情報採取サイトへの信用供与など、作戦を推進するためにSSL/TLS証明書をインストールすることがあり ます。電子証明書のインストールは、Web サーバーや電子メールサーバーなど、さまざまな種類のサーバーに対して行われることがあります。

Adversaries can obtain digital certificates (see Digital Certificates) or create self-signed certificates (see Digital Certificates). Digital certificates can then be installed on adversary controlled infrastructure that may have been acquired (Acquire Infrastructure) or previously compromised (Compromise Infrastructure).

攻撃者は、電子証明書を入手したり、自己署名証明書を作成したりすることができます(「電子証明書」を参照)。そして、電子証明書は、獲得した(Acquire Infrastructure)、または以前に侵害した(Compromise Infrastructure)、攻撃者の管理するインフラストラクチャにインストールすることができます。

ID: T1608.003
Sub-technique of:  T1608
Platforms: PRE
Version: 1.1
Created: 17 March 2021
Last Modified: 16 October 2021


ID Mitigation Description
M1056 Pre-compromise

This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.


ID Data Source Data Component Detects
DS0035 Internet Scan Response Content

Consider use of services that may aid in the tracking of certificates in use on sites across the Internet. In some cases it may be possible to pivot on known pieces of certificate information to uncover other adversary infrastructure.[2]Detection efforts may be focused on related behaviors, such as Web Protocols or Asymmetric Cryptography.