SecureAEye LAB ONLINE · SIG 657 · DET ~41s

← All attacks / Identity, authentication and credential attacks

CA key theft / forged certs

CA private key stolen to forge unrevokable certs for any user

categoryIdentity, authentication and credential attacksseverityVery HighdetectabilityHighlabnot yet measured

Example: PERSIST1–3

Classification

31 values: 17 imported, 1 derived, 13 machine-classified. What do these mean?

Exploitability

Attack vector	Credential attacks
Reach (CVSS)	Network
Attack complexity	Low
Privileges required	High
User interaction	None
Attacker skill required	High
Resources required	Low
Likelihood / prevalence	Low
Maturity	Established

Impact & scope

Severity	Very High
Impact	ConfidentialityIntegrity
Platform	Identity ProviderLinuxmacOSNetwork DevicesWindows
Environment	On-premises
Target asset class	Identity
Kill-chain phase (tactic)	Credential Access

Detection & telemetry

Detectability	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Active Directory Credential RequestActive Directory Object ModificationApplication Log ContentCommand ExecutionFile AccessFile CreationNetwork Share AccessProcess CreationWindows Registry Key Access

Detection & response

Mitigated by 35

Detected by 20

DET0240 attack-detection-strategy
DET0549 attack-detection-strategy
1f978c6a-4415-47fb-aca5-736a44d7ca3d sigma
213d6a77-3d55-4ce8-ba74-fcfef741974e sigma
2a9e4f17-6c3b-4d8a-e1f0-b57c2d94a631 sigma
58c0bff0-40a0-46e8-b5e8-b734b84d2017 sigma
6938366d-8954-4ddc-baff-c830b3ba8fcd sigma
762f2482-ff21-4970-8939-0aa317a886bb sigma
7892ec59-c5bb-496d-8968-e5d210ca3ac4 sigma
8b7e2c54-1f93-4a6d-b8e0-3c9d7f25a168 sigma
94309181-d345-4cbf-b5fe-061769bdf9cb sigma
9c5d2b84-1f7e-4a3c-d6b8-e04f9a17c523 sigma
9e716b33-63b2-46da-86a4-bd3c3b9b5dfb sigma
aa7a3fce-bef5-4311-9cc1-5f04bb8c308c sigma
b2815d0d-7481-4bf0-9b6c-a4c48a94b349 sigma
b2e4a719-3c8f-4d1b-a507-f83c2d56e901 sigma
c4a1f389-2e6b-4d9a-8f0c-b73e5a12d947 sigma
dca1b3e8-e043-4ec8-85d7-867f334b5724 sigma
e2b5163d-7deb-4566-9af3-40afea6858c3 sigma
fa0bac5f-d170-4a91-9780-1ad71dc1f49e sigma

Tested by 18

12e4a260-a7fd-4ed8-bf18-1a28c1395775 atomic
290df60e-4b5d-4a5e-b0c7-dc5348ea0c86 atomic
2a5a0601-f5fb-4e2e-aa09-73282ae6afca atomic
336b25bf-4514-4684-8924-474974f28137 atomic
42c55554-3dcb-4df6-8fbb-c8ccacc478d4 atomic
46959285-906d-40fa-9437-5a439accd878 atomic
520ce462-7ca7-441e-b5a5-f8347f632696 atomic
5e417277-0ae7-4ad5-a3e8-0fa27c122b29 atomic
7617f689-bbd8-44bc-adcd-6f8968897848 atomic
78b274f8-acb0-428b-b1f7-7b0d0e73330a atomic
78e95057-d429-4e66-8f82-0f060c1ac96f atomic
7c247dc7-5128-4643-907b-73a76d9135c3 atomic
864bb0b2-6bb5-489a-b43b-a77b3a16d68a atomic
922b1080-0b95-42b0-9585-b9a5ea0af044 atomic
b05ac39b-515f-48e9-88e9-2f141b5bcad0 atomic
cab413d8-9e4a-4b8d-9b84-c985bd73a442 atomic
e7568442-1b7d-4380-a933-b269d1326b6c atomic
eb121494-82d1-4148-9e2b-e624e03fbf3d atomic

Attack relationships

Parent: API key / secret leakage
Parent: CI/CD credential hygiene failures

Framework references

Primary source: https://specterops.io/blog/2021/06/17/certified-pre-owned/
attack: T1649 (primary)
attack: T1552.004

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Identity, authentication and credential attacks' table, line 370 of Cyber-Attack-Taxonomy.md
ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1649, attack:T1552.004 as the nearest framework entries; ids verified to exist in the cached catalogues.
ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 23 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 4 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)