Try in Splunk Security Cloud

Description

Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint, Risk
  • Last Updated: 2023-02-01
  • Author: Michael Haag, Splunk
  • ID: b92b4ac7-0026-4408-a6b5-c1d20658e124

Narrative

The following analytic story focuses on remote and local endpoint certificate theft and abuse. Authentication certificates can be both stolen and forged. For example, AD CS certificates can be stolen from encrypted storage (in the Registry or files), misplaced certificate files (i.e. Unsecured Credentials), or directly from the Windows certificate store via various crypto APIs.With appropriate enrollment rights, users and/or machines within a domain can also request and/or manually renew certificates from enterprise certificate authorities (CA). This enrollment process defines various settings and permissions associated with the certificate. Abusing certificates for authentication credentials may enable other behaviors such as Lateral Movement. Certificate-related misconfigurations may also enable opportunities for Privilege Escalation, by way of allowing users to impersonate or assume privileged accounts or permissions via the identities (SANs) associated with a certificate. These abuses may also enable Persistence via stealing or forging certificates that can be used as Valid Accounts for the duration of the certificate’s validity, despite user password resets. Authentication certificates can also be stolen and forged for machine accounts. (MITRE ATT&CK)

Detections

Name Technique Type
Certutil exe certificate extraction   TTP
Detect Certify Command Line Arguments Steal or Forge Authentication Certificates, Ingress Tool Transfer TTP
Detect Certify With PowerShell Script Block Logging Steal or Forge Authentication Certificates, Command and Scripting Interpreter, PowerShell TTP
Steal or Forge Authentication Certificates Behavior Identified Steal or Forge Authentication Certificates Correlation
Windows Export Certificate Private Keys, Unsecured Credentials, Steal or Forge Authentication Certificates Anomaly
Windows Mimikatz Crypto Export File Extensions Steal or Forge Authentication Certificates Anomaly
Windows PowerShell Export Certificate Private Keys, Unsecured Credentials, Steal or Forge Authentication Certificates Anomaly
Windows PowerShell Export PfxCertificate Private Keys, Unsecured Credentials, Steal or Forge Authentication Certificates Anomaly
Windows Steal Authentication Certificates - ESC1 Authentication Steal or Forge Authentication Certificates, Use Alternate Authentication Material TTP
Windows Steal Authentication Certificates CS Backup Steal or Forge Authentication Certificates Anomaly
Windows Steal Authentication Certificates CertUtil Backup Steal or Forge Authentication Certificates Anomaly
Windows Steal Authentication Certificates Certificate Issued Steal or Forge Authentication Certificates Anomaly
Windows Steal Authentication Certificates Certificate Request Steal or Forge Authentication Certificates Anomaly
Windows Steal Authentication Certificates CryptoAPI Steal or Forge Authentication Certificates Anomaly
Windows Steal Authentication Certificates Export Certificate Steal or Forge Authentication Certificates Anomaly
Windows Steal Authentication Certificates Export PfxCertificate Steal or Forge Authentication Certificates Anomaly

Reference

source | version: 1