Applied Cybernetics Group
T1587.003 Digital Certificates
- Technique
T1587.003- Tactics
- Resource Development
- Research, 90 days
- 1
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 0
- Elastic, Splunk
- 1
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1587/003
MITRE description
Adversaries may create self-signed SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. In the case of self-signing, digital certificates will lack the element of trust associated with the signature of a third-party certificate authority (CA).(Citation: Spice Works Digital Certificates) Adversaries may create self-signed SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) if added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)). After creating a digital certificate, an adversary may then install that certificate (see [Install Digital Certificate](https://attack.mitre.org/techniques/T1608/003)) on infrastructure under their control.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-10-08ESET: MATCHBOIL: New tricks, same old evil intentions