Stage Capabilities: Install Digital Certificate T1608.003

Tactic: Resource Development

Adversaries may install SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are files that can be installed on servers to enable secure communications between systems. Digital certificates include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate securely with its owner. Certificates can be uploaded to a server, then the server can be configured to use the certificate to enable encrypted communication with it.

Authoring guide

These 1 rule share fields, values, and exclusions.

Fields filtered most (2 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
aws::eventName1eq 1deleteimportedkeymaterial, importkeymaterial
aws::eventSource1eq 1kms.amazonaws.com

Top indicator values (3 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
aws::eventNameeq
deleteimportedkeymaterial
1
aws::eventNameeq
importkeymaterial
1
aws::eventSourceeq
kms.amazonaws.com
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: AWS

Domain: Cloud

Sigma 1 rule