Digital Certificates (T1596.003) is a reconnaissance sub-technique of Search Open Technical Databases. Its platform is PRE.
Certificate authorities issue certificates to verify the origin of signed content. The certificates used for HTTPS carry information about the registered organization, including its name and location.
How attackers use it
MITRE says adversaries search public digital certificate data to learn about a victim. Threat actors use online resources and lookup tools to harvest certificate information. Certificate data can also come from artifacts signed by the organization, such as the certificates served along with encrypted web traffic.
The output can lead to further reconnaissance such as Active Scanning or Phishing for Information, to establishing resources by developing or obtaining capabilities, and to initial access through External Remote Services or Trusted Relationship.
For a defender the takeaway is that every certificate you request is, in practice, an announcement. Names that appear on it are discoverable.
How to detect it
You will rarely see this. MITRE states that the activity has a high occurrence and false positive rate and may happen outside your visibility. Direct detection is hard, so focus on related stages such as Initial Access.
How to reduce the risk
MITRE's mitigation is Pre-compromise. Preventive controls cannot easily stop it, so minimize the amount and sensitivity of data available to external parties.
- Think before naming internal systems in a publicly trusted certificate.
- Keep an inventory of certificates issued for your domains, and investigate any you did not request.
- Remove services whose certificates you no longer need to maintain.
- Secure whatever the certificate names point at, since those hosts will be tried.
Check your own environment
See the certificate a host presents (openssl, any OS):
openssl s_client -connect your-domain.example:443 -servername your-domain.example </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates
Read the subject and dates. Does the organization detail match what you want public?
Quick check
Why does a public certificate help an adversary?
It contains registered organization details and hostnames that feed further reconnaissance and targeting.
