Techniques › T1608 › T1608.003
T1608.003 Install Digital Certificate
resource development — PRE · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
1
Sigma rules tagged attack.t1608.003
0
KEV CVEs mapped here
<p>Adversaries may install SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are files that can be installed on servers to enable secure communications between systems. Digital certificates include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate securely with its owner. Certificates can be uploaded to a server, then the server can be configured to use the certificate to enable encrypted communication with it.</p><p>Adversaries may install SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: Asymmetric Cryptography with Web Protocols) or lending credibility to a credential harvesting site. Installation of digital certificates may take place for a number of server types, including web servers and email servers.</p><p>Adversaries can obtain digital certificates (see Digital Certificates) or create self-signed certificates (see Digital Certificates). Digital certificates can then be installed on adversary controlled infrastructure that may have been acquired (Acquire Infrastructure) or previously compromised (Compromise Infrastructure).</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0840 Detection of Install Digital Certificate v1.0
AN1972 PREConsider use of services that may aid in the tracking of certificates in use on sites across the Internet. In some cases it may be possible to pivot on known pieces of certificate information to uncover other adversary infrastructure. Detection efforts may be focused on related behaviors, such as Web Protocols or Asymmetric Cryptography.
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1608.003
Author: toopricey
· 2025-10-18 · logsource: product=aws service=cloudtrail · 1279262f-1464-422f-ac0d-5b545320c526
Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal.
Rules tagged at the parent level (attack.t1608) 2
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2021-12-27 (modified 2022-08-02) · logsource: product=windows category=process_creation · 00d49ed5-4491-4271-a8db-650a4ef6f8c1
Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
· 2021-04-12 (modified 2022-11-27) · logsource: product=windows category=registry_event · ac8866c7-ce44-46fd-8c17-b24acff96ca8
Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure function.