Obtain Capabilities: Digital Certificates T1588.004

Tactic: Resource Development

Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner.

Authoring guide

These 1 rule share fields, values, and exclusions.

Fields filtered most (4 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
EventType1eq 1*
Listingreason1is_not_null 1
SSL_CertFingerprint1eq 1*
sourcetype1eq 1cisco:sfw:estreamer

Top indicator values (3 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
EventTypeeq
*
1
SSL_CertFingerprinteq
*
1
sourcetypeeq
cisco:sfw:estreamer
132

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Network

Domain: Network

Splunk 1 rule