Certificate theft
User/machine certs exported via Crypto API, DPAPI, file hunting or PKINIT
categoryIdentity, authentication and credential attacksseverityHighdetectability (measured in our lab)Mediumlabdetected in lab
Example: THEFT1–5
Classification
28 values: 13 reviewed, 2 lab-measured, 12 imported, 1 derived. What do these mean?
Exploitability
| Attack vector | Credential attacks |
|---|---|
| Reach (CVSS) | Local |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Attacker skill required | Medium |
| Resources required | Low |
| Likelihood / prevalence | Medium |
| Maturity | Established |
Impact & scope
| Severity | High |
|---|---|
| Impact | Confidentiality |
| Platform | Identity ProviderLinuxmacOSWindows |
| Environment | CloudOn-premises |
| Target asset class | Identity |
| Kill-chain phase (tactic) | Credential Access |
Detection & telemetry
| Detectability (measured in our lab) | Medium |
|---|---|
| Detectability (public detection content) | High |
| Noise level | High |
| Testability | Atomic Red Team test |
| Data sources (ATT&CK data components) | Active Directory Credential RequestActive Directory Object ModificationApplication Log ContentCommand ExecutionFile AccessWindows Registry Key Access |
Detection & response
Mitigated by 24
- M1015 attack-mitigation
- M1041 attack-mitigation
- M1042 attack-mitigation
- M1047 attack-mitigation
D3-AVEd3fendD3-CAd3fendD3-CBANd3fendD3-CEROd3fendD3-CFd3fendD3-CMd3fendD3-CPd3fendD3-CQd3fendD3-DFd3fendD3-FAd3fendD3-FEd3fendD3-FEVd3fendD3-FIMd3fendD3-LFPd3fendD3-RFd3fendD3-RFAMd3fendD3-RSd3fendD3-SBVd3fendD3-SUd3fendD3-SWId3fend
Detected by 14
- DET0240 attack-detection-strategy
2a9e4f17-6c3b-4d8a-e1f0-b57c2d94a631sigma58c0bff0-40a0-46e8-b5e8-b734b84d2017sigma6938366d-8954-4ddc-baff-c830b3ba8fcdsigma762f2482-ff21-4970-8939-0aa317a886bbsigma8b7e2c54-1f93-4a6d-b8e0-3c9d7f25a168sigma94309181-d345-4cbf-b5fe-061769bdf9cbsigma9c5d2b84-1f7e-4a3c-d6b8-e04f9a17c523sigmab2e4a719-3c8f-4d1b-a507-f83c2d56e901sigmac4a1f389-2e6b-4d9a-8f0c-b73e5a12d947sigmae2b5163d-7deb-4566-9af3-40afea6858c3sigmafa0bac5f-d170-4a91-9780-1ad71dc1f49esigma100460wazuh100461wazuh
Tested by 1
eb121494-82d1-4148-9e2b-e624e03fbf3datomic
Lab findings
Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.
| Run | Outcome | Tool | Platform | Ran at |
|---|---|---|---|---|
run-2026-11-02-020 | detected | atomic | windows | 2026-11-02 |
run-2026-11-02-020— Backlog detectability-baseline probe (priority 5, 6 corpus attack(s); atomic_tests=1). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1649 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=2 incidental=29 max_level=15 dwell_s=90
Framework references
- Primary source: https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf
- attack: T1649 (primary)
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Identity, authentication and credential attacks' table, line 369 of Cyber-Attack-Taxonomy.md
- ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 4 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
- ev-0003 (Phase 4 detection lab - detonation runs 2026-11-02) — Lab detonation run-2026-11-02-020 (detected): Wazuh rule(s) 100460, 100461 fired on T1649 within the detonation window
Certificate exported from the Windows certificate store by a PowerShell script (Export-Certificate / Export-PfxCertificate over Cert:\) -- T1649