T1649 Steal or Forge Authentication Certificates

Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. For example, Entra ID device certificates and Active Directory Certificate Services (AD CS) certificates bind to an identity and can be used as credentials…

MITRE ATT&CK page ↗

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.