Techniques › T1588.004 › AN1980
AN1980 Analytic 1980
PRE · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Consider use of services that may aid in the tracking of newly issued certificates and/or certificates in use on sites across the Internet. In some cases it may be possible to pivot on known pieces of certificate information to uncover other adversary infrastructure. Some server-side components of adversary tools may have default values set for SSL/TLS certificates. Monitor for logged network traffic in response to a scan showing both protocol header and body values that may buy and/or steal SSL/TLS certificates that can be used during targeting. Detection efforts may be focused on related behaviors, such as Web Protocols, Asymmetric Cryptography, and/or Install Root Certificate.</p>
- Detects
- T1588.004 Digital Certificates
- Part of
- DET0848 Detection of Digital Certificates
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| Certificate | None | DC0093 Certificate Registration |
| Internet Scan | None | DC0104 Response Content |