Adversaries may buy or steal SSL/TLS certificates to use during targeting. MITRE files this under Resource Development, the stage where an attacker builds what they need before touching a victim. The platform is listed as PRE, which means the activity happens before any compromise of your systems.
Certificates exist to build trust. They carry a key, a claim about who owns it, and the signature of an authority that checked the claim. If the signature is valid and you trust the signer, you trust the key. That is exactly why an attacker wants one.
How attackers use it
MITRE describes two broad routes. The first is purchase, which can be done through a front organization or with information stolen from a compromised entity that lets the adversary pass a certificate provider's validation. The second is theft, including taking certificate material directly from a compromised third party, certificate authorities included.
Adversaries may also register or hijack domains first and then obtain a certificate for them. MITRE notes that some certificate authorities issue domain validation certificates for free, so cost is not a barrier.
What they do with the certificate comes next. MITRE gives two examples: encrypting command and control traffic over web protocols, and enabling adversary-in-the-middle activity when a certificate is trusted or added to the root of trust. Once obtained, the certificate is installed on infrastructure the adversary controls.
How to detect it
Most of this happens off your network, so your own logs rarely show it. MITRE's detection guidance points at the outside view instead.
Consider services that track newly issued certificates and certificates in use across the internet. In some cases you can pivot on known certificate details to uncover other adversary infrastructure. MITRE also notes that some server-side components of adversary tools ship with default certificate values, which can be matched in scan results.
Because acquisition itself is hard to see, MITRE suggests concentrating on related behaviors: web protocol use for command and control, asymmetric cryptography in that traffic, and installation of a root certificate on endpoints.
How to reduce the risk
- Accept that you cannot stop the purchase. MITRE's own mitigation entry for this technique says it cannot be easily mitigated with preventive controls, because the behavior happens outside the scope of enterprise defenses and controls.
- Protect your own certificates and private keys, since stolen certificate material is one of the routes MITRE lists. Limit who and what can read key stores.
- Watch for new certificates issued for your own domains and for lookalike domains, so a fraudulent one does not sit unnoticed.
- Treat any unexpected addition to a device's trusted root store as an incident to investigate, because that is how a certificate becomes powerful enough for interception.
- Put your effort into the later stages where you can act, such as detecting suspicious encrypted outbound traffic.
Check your own environment
- Do you know every certificate issued for your domains, and who requested each one?
- Are private keys stored where only the service that needs them can read them?
- Can you list trusted root certificates on your managed endpoints and spot an addition?
- Does someone review newly issued certificates for lookalike versions of your domain names?
Quick check
Can a defender stop an adversary from buying a certificate?
Not with preventive controls. MITRE says the behavior occurs outside enterprise defenses, so the practical response is to protect your own certificates and watch later stages of an intrusion.
Which related behaviors does MITRE suggest watching?
Web protocols, asymmetric cryptography used for command and control, and installation of a root certificate.
Sources
- MITRE ATT&CK, Digital Certificates (T1588.004): https://attack.mitre.org/techniques/T1588/004
