Install Digital Certificate (T1608.003) is a Resource Development sub-technique of Stage Capabilities. The platform is PRE: this happens on the adversary's side, before targeting begins.
An SSL/TLS certificate lets a server prove its identity and encrypt traffic. Adversaries install them on infrastructure they control for the same reasons everyone else does.
How attackers use it
MITRE gives two purposes. Certificates can encrypt command and control traffic, as in Asymmetric Cryptography over Web Protocols. They can also lend credibility to a credential harvesting site, since a padlock in the browser makes a fake page look more trustworthy. The certificates may go onto web servers or email servers.
An adversary can obtain a certificate (Digital Certificates, T1588.004) or create a self-signed one (T1587.003), then install it on infrastructure they acquired or compromised.
The one example on the page: Sea Turtle captured legitimate SSL certificates from victim organizations and installed them on Sea Turtle-controlled infrastructure to enable later adversary-in-the-middle operations.
How to detect it
MITRE suggests using services that track certificates in use across the internet. In some cases you can pivot on known pieces of certificate information to uncover other adversary infrastructure. It also points to related behaviors: Web Protocols and Asymmetric Cryptography.
For your own side of the house:
- Protect your own certificates and private keys. Sea Turtle's example shows that your certificate can end up on someone else's server.
- Monitor certificate transparency logs for your domains to spot certificates you did not request. This is a general practice rather than something on the MITRE page.
- Do not treat HTTPS as proof of legitimacy in user training. A padlock says the connection is encrypted, not that the site is honest.
How to reduce the risk
MITRE says this cannot easily be mitigated with preventive controls because it relies on actions outside enterprise defenses. Keep private keys in hardened storage with limited access, shorten certificate lifetimes where you can, and make sure phishing training covers lookalike sites that have valid certificates.
Quick check
Why does a valid certificate not prove a site is safe?
Adversaries can obtain or create certificates and install them on their own servers, including to make credential harvesting pages look credible.
