Home/ MITRE Matrix/ Credential Access/ T1649

T1649Steal or Forge Authentication Certificates

T1649 — Steal or Forge Authentication Certificates is a MITRE ATT&CK technique in the Credential Access tactic. Clankerusecase tracks 18 detection use cases covering it and 3 threat-intel articles citing it.

Credential Access

View on the matrix → Filter Detection Library MITRE official spec ↗

18Use cases

3Articles

0Sub-techniques

1Tactic

Use cases covering this technique (18)

Certutil exe certificate extraction ESCU actions · alerting P Detect Certify Command Line Arguments ESCU actions · alerting P Detect Certify With PowerShell Script Block Logging ESCU actions · alerting P Detect Certipy File Modifications ESCU actions · alerting P Steal or Forge Authentication Certificates Behavior Identified ESCU actions · alerting P Windows Export Certificate ESCU actions · hunting P Windows Mimikatz Crypto Export File Extensions ESCU actions · hunting P Windows PowerShell Export Certificate ESCU actions · hunting P Windows PowerShell Export PfxCertificate ESCU actions · hunting P Windows Steal Authentication Certificates - ESC1 Abuse ESCU actions · alerting P Windows Steal Authentication Certificates - ESC1 Authentication ESCU actions · alerting P Windows Steal Authentication Certificates Certificate Issued ESCU actions · hunting P Windows Steal Authentication Certificates Certificate Request ESCU actions · hunting P Windows Steal Authentication Certificates CertUtil Backup ESCU actions · hunting P Windows Steal Authentication Certificates CryptoAPI ESCU actions · hunting P Windows Steal Authentication Certificates CS Backup ESCU actions · hunting P Windows Steal Authentication Certificates Export Certificate ESCU actions · hunting P Windows Steal Authentication Certificates Export PfxCertificate ESCU actions · hunting P

Articles citing this technique (3)

high Certighost and the Privilege Hiding in Your Certificate Authority art-17

crit Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack art-78

high Using Snyk reporting for data-driven security art-1918